From bc9d715f8d6d4fd8255028dce9d684ad21c03e2e Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 17:16:00 -0400 Subject: [PATCH 01/16] Add VEX generation/advisor and Blueprint connection-ID resolution MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - VEXGenerator: new `vex` subcommand generating a CycloneDX 1.6 VEX for an application's library CVEs, using Contrast's Libraries (SCA) and CVE Shield/Protect APIs. Policy: code_not_reachable when a library's classes were never loaded, protected_at_runtime when CVE Shield/Protect is active, no statement for exposed/exploited CVEs, and a duration-gated not_affected/in_triage claim (--vex-accept-after-days) when a CVE's code path has never been observed executing. --env scopes claims to a single environment instead of the app's dev/qa/prod combined. - VEXAdvisor: new `vex-advisor` subcommand / `vex --analyze` - AI review of whether each generated VEX claim is safe to rely on given the CVE's severity/exploitability, writing contrast:vexAdvisorAssessment/Rationale back onto each vulnerability. - BlueprintGenerator: new `blueprint` subcommand (CycloneDX 2.0-dev draft ABOM + Bill of Behaviors), wired into Main. - AppGraphInfo/ApplicationGraphFetcher: track connected application IDs alongside display names, so Blueprint can resolve a graph connection back to an existing asset instead of creating a duplicate. - README: document all of the above. 🤖 Generated with Claude Code --- .gitignore | 1 + README.md | 197 ++--- .../runtimeanalyst/AppGraphInfo.java | 14 + .../ApplicationGraphFetcher.java | 9 + .../runtimeanalyst/BlueprintGenerator.java | 749 ++++++++++++++++++ .../contrastsecurity/runtimeanalyst/Main.java | 18 +- .../runtimeanalyst/VEXAdvisor.java | 498 ++++++++++++ .../runtimeanalyst/VEXGenerator.java | 631 +++++++++++++++ 8 files changed, 1987 insertions(+), 130 deletions(-) create mode 100644 src/main/java/com/contrastsecurity/runtimeanalyst/BlueprintGenerator.java create mode 100644 src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java create mode 100644 src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java diff --git a/.gitignore b/.gitignore index a972429..233a436 100644 --- a/.gitignore +++ b/.gitignore @@ -21,6 +21,7 @@ CLAUDE.md cbom*.json aibom*.json blueprint*.json +vex*.json # Shell scripts (may contain credentials) *.sh diff --git a/README.md b/README.md index 94122e1..c3c9626 100644 --- a/README.md +++ b/README.md @@ -1,24 +1,19 @@ # Runtime Analyst -Runtime Analyst turns Contrast Security's runtime observability data into structured, standard reports, across three domains: +Runtime Analyst turns Contrast Security's runtime observability data into structured, standard reports. RA doesn't scan source code or dependency manifests - it reads what Contrast's agents observed actually running in your applications, with full stack traces, usage counts, and architecture context. This runtime visibility is critical for post-quantum migration and AI governance planning - you need to know not just *what's* in use, but *how* it's being used and by *what*. -- **Crypto** - every cryptographic algorithm observed running in your applications, with NIST post-quantum vulnerability classification -- **AI** - every AI model and provider observed running, with cloud-vs-local classification for shadow-AI visibility -- **Blueprint (alpha)** - a map of how your applications connect and behave: assets, deployment zones, connections, and crypto/AI behaviors - -For Crypto and AI, it produces both a [CycloneDX](https://cyclonedx.org/) Bill of Materials - **CBOM** and **AI-BOM** - and an AI-powered analysis report - **Quantum Advisor** and **AI Advisor** - that classifies findings, explains what each application actually does, and writes its analysis back into the BOM itself. Blueprint (alpha) produces only a draft CycloneDX 2.0 Architectural BOM + Bill of Behaviors; it doesn't have an analysis report yet. - -It doesn't scan source code or dependency manifests - it reads what Contrast's agents observed actually running in your applications, with full stack traces, usage counts, and architecture context. +- **Cryptography** - every cryptographic algorithm observed running in your apps/APIs, with NIST post-quantum vulnerability classification. Produces a CBOM and an AI-powered analysis report. +- **AI** - every AI model and provider observed running, with cloud-vs-local classification for shadow-AI visibility. Produces a AIBOM and an AI-powered analysis report +- **Blueprint (alpha)** - a map of how your apps/APIs connect and behave: assets, deployment zones, connections, and crypto/AI behaviors +- **Threat Model** (coming soon) - TBD +- **Vulnerability Exclusion** - an analysis of library CVE exposure in your apps/APIs, based Contrast's runtime library-usage and CVE Shield/Protect data. Produces a VEX document and an AI-powered analysis report. **Requirements:** - A Contrast account with runtime data already flowing in from real-world applications and APIs - Contrast's agents must actually be deployed and observing traffic. Runtime Analyst only reports on what Contrast has observed; it has nothing to show against an account with no instrumented applications or no production/QA traffic. -- Java 17+ and Maven to build. - The `claude` CLI on your `PATH` and logged in, for `--analyze`/the advisor reports - no separate API key, no AWS/Bedrock credentials, no Python. -One jar, one command per report type. - -## Why Contrast for This? +## Why Contrast? Contrast provides runtime observability that goes far beyond static code scanning or self-reported inventories: @@ -31,36 +26,11 @@ Contrast provides runtime observability that goes far beyond static code scannin - **Application dependencies** - Which apps and APIs depend on each crypto algorithm or AI model - **Real connections, not guesses** - Blueprint's assets, zones, and flows come from the same architecture graph, so the map it draws is what Contrast actually saw talking to what, not an inferred or self-reported topology -This runtime visibility is critical for post-quantum migration and AI governance planning - you need to know not just *what's* in use, but *how* it's being used and by *what*. - -## `--help` - -``` -$ java -jar runtime-analyst.jar - -Runtime Analyst - Contrast Security Bill of Materials generator -Usage: - java -jar runtime-analyst.jar auth [options] Connect to Contrast and generate contrast.properties - java -jar runtime-analyst.jar cbom [options] Generate a Cryptography Bill of Materials - java -jar runtime-analyst.jar aibom [options] Generate an AI/LLM usage Bill of Materials - java -jar runtime-analyst.jar blueprint [options] Generate a CycloneDX Blueprint (ABOM + Bill of Behaviors) - java -jar runtime-analyst.jar cbom-advisor Re-run the Quantum Advisor against an existing CBOM - java -jar runtime-analyst.jar aibom-advisor Re-run the AI Advisor against an existing AI-BOM - -`cbom --analyze` / `aibom --analyze` already run the matching advisor automatically after generation - -the standalone cbom-advisor/aibom-advisor commands are for re-running the advisor without regenerating the BOM. - -Run with -h after a subcommand for its options, e.g.: - java -jar runtime-analyst.jar cbom -h - java -jar runtime-analyst.jar aibom -h -``` - -Every subcommand supports `-h`/`--help` for its own options - see [Examples](#examples) below for each one's full help text. ## Authentication -Every command except `auth` itself reads a `contrast.properties` file for credentials. If `cbom`, `aibom`, or `blueprint` don't find one (or the one named with `-c`), they run `auth` for you automatically first, then proceed with the command you actually asked for - so you never have to run `auth` yourself as a separate step. You can also set up `contrast.properties` ahead of time, two ways: +Every command except `auth` itself reads a `contrast.properties` file for credentials. If `cbom`, `aibom`, `blueprint`, or `vex` don't find one (or the one named with `-c`), they run `auth` for you automatically first, then proceed with the command you actually asked for - so you never have to run `auth` yourself as a separate step. You can also set up `contrast.properties` ahead of time, two ways: **Option 1 - `auth` (recommended):** @@ -68,20 +38,9 @@ Every command except `auth` itself reads a `contrast.properties` file for creden java -jar runtime-analyst.jar auth --host https://your-instance.contrastsecurity.com ``` -This opens a real browser window and lets you log in exactly the way you normally would, including SSO/MFA - there's nothing to copy or paste. The window closes as soon as login completes; in the background, it reads your personal API key, service key, and organization ID directly off your account's **User Settings > Your Keys** page, verifies them with a real API call, and writes `contrast.properties` for you. Your session cookie is never read or stored - only the API key and service key that page shows you. - -**Option 2 - create it by hand:** - -```properties -contrast.url=https://your-instance.contrastsecurity.com/api/ns-ui/v1 -contrast.org_id=your-org-id -contrast.auth_header=base64-encoded-email:service-key -contrast.api_key=your-api-key -``` +Every command accepts `-c ` to point at a config file somewhere other than the working directory. -Find these values yourself under **User Settings > Your Keys** in the Contrast UI. `contrast.auth_header` is the base64 encoding of `your-email:your-service-key` (not the service key alone). -Every command accepts `-c ` to point at a config file somewhere other than the working directory. ## Usage @@ -97,10 +56,12 @@ A single jar, dispatched by subcommand: | `cbom` | Generate a Cryptography Bill of Materials | | `aibom` | Generate an AI/LLM usage Bill of Materials | | `blueprint` (alpha) | Generate a draft CycloneDX 2.0 Architectural BOM + Bill of Behaviors | +| `vex` | Generate a CycloneDX VEX for an application's library CVEs | | `cbom-advisor` | Re-run the Quantum Advisor against an existing CBOM file | | `aibom-advisor` | Re-run the AI Advisor against an existing AI-BOM file | +| `vex-advisor` | Re-run the VEX Advisor against an existing VEX file | -`cbom`, `aibom`, and `blueprint` all share the same filter flags: `--app `, `--env `, `--list` (list available applications and exit), `-o ` (output path), and `-c `. `cbom`/`aibom` additionally support `--analyze`, which runs the matching advisor automatically after generation. +`cbom`, `aibom`, `blueprint`, and `vex` all share `--app `, `--env `, `--list` (list available applications and exit), `-o ` (output path), and `-c `. For `cbom`/`aibom`/`blueprint`, `--env` filters which observations are included. For `vex`, `--env` means something more specific: it scopes each claim to that one environment's CVE Shield/exposure status, instead of considering the application's dev/qa/prod combined (see the `vex` policy below) - `--env PRODUCTION` means "not seen/protected in production specifically," not "not seen somewhere across the app." `cbom`/`aibom`/`vex` additionally support `--analyze`, which runs the matching advisor automatically after generation. `vex` also has its own `--vex-accept-after-days ` (see below). ## Examples @@ -109,23 +70,11 @@ A single jar, dispatched by subcommand: ``` $ java -jar runtime-analyst.jar auth -h -Auth - connect runtime-analyst to your Contrast account - -Opens a real browser window, lets you log in (including SSO/MFA) the way you normally -would, then reads your personal API key/service key/org id off User Settings > Your Keys -directly - no manual copy/paste into the terminal. The window closes as soon as login -completes; everything after that runs in a background headless browser. - -Usage: - java -jar runtime-analyst.jar auth [--host ] [-o ] -``` - -```bash # First-time setup against your instance -java -jar runtime-analyst.jar auth --host https://eval.contrastsecurity.com +$ java -jar runtime-analyst.jar auth --host https://eval.contrastsecurity.com # Write to a different config path -java -jar runtime-analyst.jar auth --host https://eval.contrastsecurity.com -o prod.properties +$ java -jar runtime-analyst.jar auth --host https://eval.contrastsecurity.com -o prod.properties ``` ### `cbom` @@ -133,98 +82,70 @@ java -jar runtime-analyst.jar auth --host https://eval.contrastsecurity.com -o p ``` $ java -jar runtime-analyst.jar cbom -h -CBOM Generator - Create CycloneDX CBOM from Contrast observations - -Usage: - java -jar runtime-analyst.jar cbom Generate CBOM for all apps - java -jar runtime-analyst.jar cbom --app Filter by app (ID or name) - java -jar runtime-analyst.jar cbom --env Filter by environment (PRODUCTION, DEVELOPMENT, QA) - java -jar runtime-analyst.jar cbom --list List available applications with IDs - java -jar runtime-analyst.jar cbom --analyze Run Quantum Advisor AI analysis after CBOM generation - java -jar runtime-analyst.jar cbom -o Specify output filename - java -jar runtime-analyst.jar cbom -c Use custom config file -``` - -```bash -java -jar runtime-analyst.jar cbom # all apps -> cbom.json -java -jar runtime-analyst.jar cbom --list # list applications and their IDs -java -jar runtime-analyst.jar cbom --app "MyApp" # filter by app name -java -jar runtime-analyst.jar cbom --app 7136cb1b-f846-4c1d-bdd3-77b448cbd2fe # ...or by ID -java -jar runtime-analyst.jar cbom --env PRODUCTION # only prod observations +java -jar runtime-analyst.jar cbom # all apps -> cbom.json +java -jar runtime-analyst.jar cbom --list # list applications and their IDs +java -jar runtime-analyst.jar cbom --app "MyApp" # filter by app name +java -jar runtime-analyst.jar cbom --app 7136cb1b-f846-4c1d-bdd3-77b448cbd2fe +java -jar runtime-analyst.jar cbom --env PRODUCTION # only prod observations java -jar runtime-analyst.jar cbom --app "MyApp" --env PRODUCTION -o myapp-prod.json java -jar runtime-analyst.jar cbom -c prod.properties --list -java -jar runtime-analyst.jar cbom --analyze # + Quantum Advisor risk report +java -jar runtime-analyst.jar cbom --analyze # + Quantum Advisor risk report ``` -### `aibom` -``` -$ java -jar runtime-analyst.jar aibom -h -AI-BOM Generator - Create CycloneDX AI-BOM from Contrast AI usage observations +### `aibom` -Usage: - java -jar runtime-analyst.jar aibom Generate AI-BOM for all apps - java -jar runtime-analyst.jar aibom --app Filter by app (ID or name) - java -jar runtime-analyst.jar aibom --env Filter by environment (PRODUCTION, DEVELOPMENT, QA) - java -jar runtime-analyst.jar aibom --list List available applications with IDs - java -jar runtime-analyst.jar aibom --analyze Run AI Advisor analysis after AI-BOM generation - java -jar runtime-analyst.jar aibom -o Specify output filename - java -jar runtime-analyst.jar aibom -c Use custom config file ``` +$ java -jar runtime-analyst.jar aibom -h -```bash java -jar runtime-analyst.jar aibom java -jar runtime-analyst.jar aibom --list java -jar runtime-analyst.jar aibom --app "MyApp" --env PRODUCTION -java -jar runtime-analyst.jar aibom --analyze # + AI Advisor governance report +java -jar runtime-analyst.jar aibom --analyze # + AI Advisor governance report ``` -### `blueprint` (alpha) -``` -$ java -jar runtime-analyst.jar blueprint -h -Blueprint Generator - Create a CycloneDX Blueprint (ABOM + Bill of Behaviors) from Contrast data - -Usage: - java -jar runtime-analyst.jar blueprint Generate a Blueprint for all apps - java -jar runtime-analyst.jar blueprint --app Filter by app (ID or name) - java -jar runtime-analyst.jar blueprint --env Filter by environment (PRODUCTION, DEVELOPMENT, QA) - java -jar runtime-analyst.jar blueprint --list List available applications with IDs - java -jar runtime-analyst.jar blueprint -o Specify output filename - java -jar runtime-analyst.jar blueprint -c Use custom config file +### `blueprint` (alpha) -Note: Blueprints are a CycloneDX draft (unreleased 2.0-dev branch, spec PR #652). -This command populates assets/zones/flows/behaviors from real Contrast data only - -it does not generate threats/controls/risks (TM-BOM), which would require fabricating -findings Contrast's telemetry cannot back. ``` +$ java -jar runtime-analyst.jar blueprint -h -```bash java -jar runtime-analyst.jar blueprint java -jar runtime-analyst.jar blueprint --app "MyApp" --env PRODUCTION ``` -### `cbom-advisor` / `aibom-advisor` -Re-run an advisor against a BOM you already have, without regenerating it: -``` -$ java -jar runtime-analyst.jar cbom-advisor -Usage: java -jar runtime-analyst.jar cbom-advisor [-v] [-o report.md] [--json out.json] [--no-confirm] [--filter all|vulnerable|asymmetric] +### `vex` -$ java -jar runtime-analyst.jar aibom-advisor -Usage: java -jar runtime-analyst.jar aibom-advisor [-v] [-o report.md] [--json out.json] [--no-confirm] ``` +$ java -jar runtime-analyst.jar vex -h -```bash -java -jar runtime-analyst.jar cbom-advisor cbom.json -o report.md -java -jar runtime-analyst.jar aibom-advisor aibom.json -o report.md -java -jar runtime-analyst.jar cbom-advisor cbom.json -v -o report.md --filter vulnerable +java -jar runtime-analyst.jar vex --app "MyApp" # -> vex-MyApp.json, considers dev+qa+prod together +java -jar runtime-analyst.jar vex --app "MyApp" --env PRODUCTION # scope every claim to production only +java -jar runtime-analyst.jar vex --list # list applications and their IDs +java -jar runtime-analyst.jar vex --app "MyApp" --vex-accept-after-days 60 -o vex.json +java -jar runtime-analyst.jar vex --app "MyApp" --analyze # + VEX Advisor soundness review ``` -Everything - BOM generation and AI analysis - runs in a single JVM process. The advisors shell out to the `claude` CLI already logged in to this shell; no separate API key or AWS/Bedrock credentials needed, and no Python required. + + +By default a claim considers the application's dev/qa/prod environments together - "protected" means protected in at least one, "not seen" means not seen in any of them. `--env ` narrows every claim to just that one environment instead, so `--env PRODUCTION` means "not seen/protected in production specifically," not "not seen somewhere in the app." An exclusion is generated when: + +1. **Library never loaded at runtime in this application** (`classes_used == 0` for that app) + → `not_affected` +2. **Library loaded, but CVE Shield/Protect is actively mitigating it for this application** + → `not_affected` / `protected_at_runtime`. +3. **Library loaded, and this application's CVE status is `EXPOSED`/`EXPLOITED`** + → no VEX statement at all. This tool never suppresses a vulnerability it can't positively account for. +4. **Library loaded, but the CVE has never been observed executing in this application** + → a statement is still generated, with the actual number of days recorded as the reason. + +Every statement carries `contrast:*` properties (`classesUsed`/`classCount`, `daysObserved`, `acceptAfterDays`, `envFilter`, and the per-environment `devStatus`/`qaStatus`/`prodStatus`) so a reviewer can see the underlying evidence, not just the resulting state. + + ## Output @@ -270,12 +191,32 @@ A draft CycloneDX 2.0 document with a top-level `blueprints[]` array containing: Deliberately does **not** generate threats, controls, or risks (TM-BOM) - the draft spec models those as a separate, sibling construct, and none of it can be derived from Contrast telemetry without an actual STRIDE-style analysis. +### VEX + +A standard CycloneDX 1.6 document with a top-level `vulnerabilities[]` array, one entry per (application, library, CVE) with: + +- `id` - the CVE identifier, `source` - NVD reference +- `ratings[]` - CVSS v3.1 score/severity/vector as reported by Contrast +- `affects[].ref` - a best-effort `pkg:maven/...` purl for the affected library +- `analysis.state`/`analysis.justification`/`analysis.detail` - the VEX claim itself and why it was made (see the policy in the [`vex` examples](#vex) above) +- `properties[]` - the underlying evidence (`contrast:classesUsed`/`classCount`, `contrast:daysObserved`, `contrast:acceptAfterDays`, `contrast:devStatus`/`qaStatus`/`prodStatus`) + +``` +Contrast VEX +└── SAML-PetClinic-Demo + ├── CVE-2018-14721 (jackson-databind 2.8.8) → not_affected / code_not_reachable + └── CVE-2022-22965 (spring-webmvc 4.3.9) → not_affected (288 days, no observed execution) +``` + +Note: `PROTECTED_AT_RUNTIME` (CVE Shield/Protect actively mitigating) is implemented but not yet confirmed against a live example with that status - see the caveats in the `vex` command's own help/design notes before relying on it. + ### Advisor reports - **Quantum Advisor** - findings grouped by risk level (CRITICAL/HIGH/MEDIUM/LOW/NOT_QUANTUM_ISSUE), with an "Application Context" section describing each app from its architecture graph data - **AI Advisor** - organized as an inventory of AI-enabled applications (one section per app, not per finding): an AI-generated description of what the app does, then each AI usage instance with model/provider/endpoint and a description of what that specific call is doing, inferred from the key methods around it in the stack trace +- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Organized one section per application, with a per-CVE table plus rationale for anything flagged. -Both advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component - this happens automatically as part of every run, no separate step needed. +Both the Quantum and AI Advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component. The VEX Advisor writes `contrast:vexAdvisorAssessment` (`sound`/`needs_review`) and `contrast:vexAdvisorRationale` back onto each vulnerability's `properties[]`. All of this happens automatically as part of every `--analyze` run, no separate step needed. ## BOM Viewer diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/AppGraphInfo.java b/src/main/java/com/contrastsecurity/runtimeanalyst/AppGraphInfo.java index c8e931e..aacab06 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/AppGraphInfo.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/AppGraphInfo.java @@ -1,6 +1,8 @@ package com.contrastsecurity.runtimeanalyst; +import java.util.HashMap; import java.util.HashSet; +import java.util.Map; import java.util.Set; /** @@ -20,4 +22,16 @@ public class AppGraphInfo { public int serverCount; public int libraryCount; public Set connectedApplications = new HashSet<>(); + + /** + * For entries in connectedApplications that are themselves other Contrast applications + * (as opposed to a server/library cluster), maps the connected application's + * contrast-graph display name to its applicationId. The graph's display name for an + * application does not always match that application's "applicationName" as reported by + * the /observations endpoint, so consumers that need to resolve a connection back to an + * application they already know about (e.g. to link a Blueprint flow to an existing asset + * instead of creating a spurious duplicate) should resolve via this map by id first, and + * only fall back to matching on the name string. + */ + public Map connectedApplicationIds = new HashMap<>(); } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/ApplicationGraphFetcher.java b/src/main/java/com/contrastsecurity/runtimeanalyst/ApplicationGraphFetcher.java index d450541..14b4898 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/ApplicationGraphFetcher.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/ApplicationGraphFetcher.java @@ -142,6 +142,8 @@ public static Map fetch( if (sourceAppId != null && targetAppId != null) { addConnection(result, sourceAppId, appNameFor(nodesByGraphId, target)); addConnection(result, targetAppId, appNameFor(nodesByGraphId, source)); + addConnectionId(result, sourceAppId, appNameFor(nodesByGraphId, target), targetAppId); + addConnectionId(result, targetAppId, appNameFor(nodesByGraphId, source), sourceAppId); continue; } @@ -169,6 +171,13 @@ private static void addConnection(Map result, String appId } } + private static void addConnectionId(Map result, String appId, String connectedName, String connectedAppId) { + AppGraphInfo info = result.get(appId); + if (info != null && connectedName != null && connectedAppId != null) { + info.connectedApplicationIds.put(connectedName, connectedAppId); + } + } + private static void tallyCluster(Map result, String appId, JsonObject clusterNode) { if (clusterNode == null) return; AppGraphInfo info = result.get(appId); diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/BlueprintGenerator.java b/src/main/java/com/contrastsecurity/runtimeanalyst/BlueprintGenerator.java new file mode 100644 index 0000000..1820d35 --- /dev/null +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/BlueprintGenerator.java @@ -0,0 +1,749 @@ +package com.contrastsecurity.runtimeanalyst; + +import java.io.File; +import java.io.FileInputStream; +import java.io.FileWriter; +import java.io.IOException; +import java.io.InputStream; +import java.util.ArrayList; +import java.util.Date; +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Properties; +import java.util.Set; +import java.util.UUID; + +import org.apache.http.HttpResponse; +import org.apache.http.client.methods.HttpGet; +import org.apache.http.client.methods.HttpPost; +import org.apache.http.entity.StringEntity; +import org.apache.http.impl.client.CloseableHttpClient; +import org.apache.http.impl.client.HttpClients; +import org.apache.http.util.EntityUtils; + +import com.google.gson.Gson; +import com.google.gson.GsonBuilder; +import com.google.gson.JsonArray; +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +/** + * Generates a CycloneDX "Blueprint" (Architectural BOM + Bill of Behaviors) from Contrast + * API data: the contrast-graph architecture/connection graph plus crypto-algorithm and + * ai-usage observations, reclassified as entries from the CycloneDX behavior taxonomy. + * + * Blueprints are not yet part of a ratified CycloneDX release. As of this writing, + * cyclonedx-core-java (and CycloneDX 1.7) have no model classes or schema for them - the + * only draft schema is on the unreleased "2.0-dev" branch of CycloneDX/specification + * (open PR https://github.com/CycloneDX/specification/pull/652, + * schema/2.0/model/cyclonedx-blueprint-2.0.schema.json / + * cyclonedx-behavior-2.0.schema.json / behavior-taxonomy.schema.json). This generator + * hand-builds JSON matching that draft shape via Gson rather than typed model classes, + * and will need to be revisited once the spec (and a library that supports it) lands. + * + * Only the parts of a Blueprint that Contrast's runtime data can actually back are + * populated: assets (from the architecture graph), zones (from deployment tier), flows + * (from architecture graph connections), and behavior instances (from crypto/AI usage + * observations, mapped onto the CycloneDX behavior taxonomy). Threat modeling (TM-BOM) - + * threats, scenarios, controls, risks - is a separate, sibling top-level construct in the + * draft spec and is intentionally out of scope here: none of it can be derived from + * Contrast telemetry without an actual STRIDE-style analysis, so generating it would mean + * fabricating findings rather than reporting observed facts. + * + * Usage: + * java -jar runtime-analyst.jar blueprint # Fetch all apps, output blueprint.json + * java -jar runtime-analyst.jar blueprint --app "AppName" # Fetch single app + * java -jar runtime-analyst.jar blueprint --list # List available applications + * java -jar runtime-analyst.jar blueprint -o custom.json # Custom output filename + * java -jar runtime-analyst.jar blueprint -c config.properties + * + * Config file (contrast.properties): + * contrast.url=https://your-instance.contrastsecurity.com/api/ns-ui/v1 + * contrast.org_id=your-org-id + * contrast.auth_header=base64-encoded-credentials + * contrast.api_key=your-api-key + */ +public class BlueprintGenerator { + + private static final String CRYPTO_ALGORITHM_RULE_ID = "crypto-algorithm"; + private static final String AI_USAGE_RULE_ID = "ai-usage"; + + private String baseUrl; + private String orgId; + private String authHeader; + private String apiKey; + private String envFilter; // PRODUCTION, DEVELOPMENT, QA, etc. + + private final Gson gson = new Gson(); + private final Gson prettyGson = new GsonBuilder().setPrettyPrinting().create(); + + public void setEnvFilter(String env) { + this.envFilter = env; + } + + public BlueprintGenerator(String configFile) throws IOException { + loadConfig(configFile); + } + + private void loadConfig(String configFile) throws IOException { + Properties props = new Properties(); + + File f; + if (configFile != null) { + f = new File(configFile); + if (!f.exists()) { + throw new IOException("Config file not found: " + configFile); + } + } else { + f = new File("contrast.properties"); + if (!f.exists()) { + throw new IOException("No contrast.properties found in current directory.\n" + + "Create one with:\n" + + " contrast.url=https://your-instance.contrastsecurity.com/api/ns-ui/v1\n" + + " contrast.org_id=your-org-id\n" + + " contrast.auth_header=base64-encoded-credentials\n" + + " contrast.api_key=your-api-key\n" + + "Or specify a config file with -c option."); + } + } + + InputStream is = new FileInputStream(f); + try { + props.load(is); + } finally { + is.close(); + } + + baseUrl = props.getProperty("contrast.url"); + orgId = props.getProperty("contrast.org_id"); + authHeader = props.getProperty("contrast.auth_header"); + apiKey = props.getProperty("contrast.api_key"); + + if (baseUrl == null || orgId == null || authHeader == null || apiKey == null) { + throw new IOException("Config file must contain: contrast.url, contrast.org_id, contrast.auth_header, contrast.api_key"); + } + } + + public static void main(String[] args) { + String appFilter = null; + String envFilter = null; + String outputFile = "blueprint.json"; + String configFile = null; + boolean listOnly = false; + + for (int i = 0; i < args.length; i++) { + if ("--app".equals(args[i]) && i + 1 < args.length) { + appFilter = args[++i]; + } else if ("--env".equals(args[i]) && i + 1 < args.length) { + envFilter = args[++i].toUpperCase(); + } else if ("--list".equals(args[i])) { + listOnly = true; + } else if ("-o".equals(args[i]) && i + 1 < args.length) { + outputFile = args[++i]; + } else if ("-c".equals(args[i]) && i + 1 < args.length) { + configFile = args[++i]; + } else if ("--help".equals(args[i]) || "-h".equals(args[i])) { + printUsage(); + System.exit(0); + } + } + + try { + BlueprintGenerator generator = new BlueprintGenerator(configFile); + generator.setEnvFilter(envFilter); + List observations = generator.fetchObservations(); + + if (listOnly) { + generator.listApplications(observations); + } else { + BlueprintResult result = generator.generateBlueprint(observations, appFilter); + + if (appFilter != null && "blueprint.json".equals(outputFile)) { + String nameForFile = result.resolvedAppName != null ? result.resolvedAppName : appFilter; + String safeAppName = nameForFile.replaceAll("[^a-zA-Z0-9-_]", "_"); + outputFile = "blueprint-" + safeAppName + ".json"; + } + + generator.writeBlueprint(result.document, outputFile); + } + } catch (Exception e) { + System.err.println("Error: " + e.getMessage()); + e.printStackTrace(); + System.exit(1); + } + } + + private static void printUsage() { + System.out.println("\nBlueprint Generator - Create a CycloneDX Blueprint (ABOM + Bill of Behaviors) from Contrast data"); + System.out.println("\nUsage:"); + System.out.println(" java -jar runtime-analyst.jar blueprint Generate a Blueprint for all apps"); + System.out.println(" java -jar runtime-analyst.jar blueprint --app Filter by app (ID or name)"); + System.out.println(" java -jar runtime-analyst.jar blueprint --env Filter by environment (PRODUCTION, DEVELOPMENT, QA)"); + System.out.println(" java -jar runtime-analyst.jar blueprint --list List available applications with IDs"); + System.out.println(" java -jar runtime-analyst.jar blueprint -o Specify output filename"); + System.out.println(" java -jar runtime-analyst.jar blueprint -c Use custom config file"); + System.out.println("\nConfig file (contrast.properties):"); + System.out.println(" contrast.url=https://your-instance.contrastsecurity.com/api/ns-ui/v1"); + System.out.println(" contrast.org_id=your-org-id"); + System.out.println(" contrast.auth_header=base64-encoded-credentials"); + System.out.println(" contrast.api_key=your-api-key"); + System.out.println("\nNote: Blueprints are a CycloneDX draft (unreleased 2.0-dev branch, spec PR #652)."); + System.out.println("This command populates assets/zones/flows/behaviors from real Contrast data only -"); + System.out.println("it does not generate threats/controls/risks (TM-BOM), which would require fabricating"); + System.out.println("findings Contrast's telemetry cannot back."); + } + + // Raw counts before dedup, keyed by "crypto:" or "ai:/" + private Map rawCounts = new HashMap<>(); + + // Application-level architecture/connection info from the Contrast graph, keyed by applicationId + private Map appGraphInfo = new HashMap<>(); + + public List fetchObservations() throws IOException { + System.out.println("\nFetching observations from Contrast API..."); + + rawCounts.clear(); + + try (CloseableHttpClient httpClient = HttpClients.createDefault()) { + JsonArray observationList = fetchObservationsList(httpClient); + System.out.println(" Found " + observationList.size() + " total observations"); + + // Dedup key: kind + algorithm/model + applicationId + route (before fetching details) + Map uniqueObservations = new HashMap<>(); + Set environmentsSeen = new HashSet<>(); + int skipped = 0; + int irrelevant = 0; + + for (JsonElement element : observationList) { + JsonObject obs = element.getAsJsonObject(); + + String ruleId = getStringOrNull(obs, "ruleId"); + Observation observation; + if (CRYPTO_ALGORITHM_RULE_ID.equals(ruleId)) { + observation = parseObservationFromList(obs); + observation.kind = "crypto"; + observation.algorithm = getStringOrNull(obs, "attackValue"); + } else if (AI_USAGE_RULE_ID.equals(ruleId)) { + observation = parseObservationFromList(obs); + observation.kind = "ai"; + AIUsageParser parser = new AIUsageParser(getStringOrNull(obs, "attackValue"), getStringOrNull(obs, "summary")); + observation.provider = parser.getProvider(); + observation.model = parser.getModel(); + } else { + irrelevant++; + continue; + } + + if (envFilter != null && !envFilter.equals(observation.environment)) { + skipped++; + continue; + } + + if (observation.environment != null) { + environmentsSeen.add(observation.environment); + } + + String rawKey = "crypto".equals(observation.kind) + ? "crypto:" + observation.algorithm + : "ai:" + observation.provider + "/" + observation.model; + rawCounts.merge(rawKey, 1, Integer::sum); + + String dedupKey = rawKey + "|" + observation.applicationId + "|" + observation.route; + if (!uniqueObservations.containsKey(dedupKey)) { + uniqueObservations.put(dedupKey, observation); + } + } + + System.out.println(" Filtered to " + (observationList.size() - irrelevant) + " crypto/AI-usage observations"); + if (skipped > 0) { + System.out.println(" Filtered to " + (observationList.size() - irrelevant - skipped) + " (env: " + envFilter + ")"); + } + System.out.println(" Deduplicated to " + uniqueObservations.size() + " unique observations"); + + System.out.print(" Fetching details for unique observations"); + for (Observation observation : uniqueObservations.values()) { + JsonObject details = fetchObservationDetails(httpClient, observation.id); + addDetailsToObservation(observation, details); + System.out.print('.'); + } + System.out.println(" done"); + + if (!environmentsSeen.isEmpty()) { + System.out.println("\nFetching application architecture/connection graph..."); + try { + appGraphInfo = ApplicationGraphFetcher.fetch(httpClient, gson, baseUrl, orgId, authHeader, apiKey, environmentsSeen); + System.out.println(" Found graph data for " + appGraphInfo.size() + " applications"); + } catch (IOException e) { + System.out.println(" Skipping graph enrichment (" + e.getMessage() + ")"); + } + } + + return new ArrayList<>(uniqueObservations.values()); + } + } + + private JsonArray fetchObservationsList(CloseableHttpClient httpClient) throws IOException { + String url = baseUrl + "/organizations/" + orgId + "/observations"; + HttpPost post = new HttpPost(url); + + post.setHeader("Authorization", authHeader); + post.setHeader("API-Key", apiKey); + post.setHeader("Content-Type", "application/json"); + post.setHeader("Accept", "application/json"); + + String requestBody = "{" + + "\"observationOrigins\":[\"OBSERVABILITY\"]," + + "\"values\":[\"MLKEM\",\"ML-KEM\",\"ML-DSA\",\"FN-DSA\"]," + + "\"excludeValues\":true," + + "\"pageable\":{" + + "\"pageSize\":1000," + + "\"sort\":[{\"property\":\"EVENT_TIME\",\"direction\":\"desc\"}]," + + "\"sortAfter\":[]" + + "}" + + "}"; + post.setEntity(new StringEntity(requestBody)); + + HttpResponse response = httpClient.execute(post); + int statusCode = response.getStatusLine().getStatusCode(); + String responseBody = EntityUtils.toString(response.getEntity()); + + if (statusCode != 200) { + throw new IOException("API returned status " + statusCode + ": " + responseBody); + } + + JsonObject jsonResponse = gson.fromJson(responseBody, JsonObject.class); + if (jsonResponse == null || !jsonResponse.has("observations")) { + throw new IOException("Invalid API response"); + } + + return jsonResponse.getAsJsonArray("observations"); + } + + private JsonObject fetchObservationDetails(CloseableHttpClient httpClient, String observationId) throws IOException { + String url = baseUrl + "/organizations/" + orgId + "/observations/" + observationId + "/details"; + HttpGet get = new HttpGet(url); + + get.setHeader("Authorization", authHeader); + get.setHeader("API-Key", apiKey); + get.setHeader("Accept", "application/json"); + + HttpResponse response = httpClient.execute(get); + int statusCode = response.getStatusLine().getStatusCode(); + String responseBody = EntityUtils.toString(response.getEntity()); + + if (statusCode != 200) { + throw new IOException("API returned status " + statusCode + " for observation " + observationId); + } + + return gson.fromJson(responseBody, JsonObject.class); + } + + private Observation parseObservationFromList(JsonObject listItem) { + Observation obs = new Observation(); + obs.id = getStringOrNull(listItem, "observationId"); + obs.eventTime = getStringOrNull(listItem, "detectedTime"); + obs.route = getStringOrNull(listItem, "httpRoute"); + obs.applicationId = getStringOrNull(listItem, "applicationId"); + obs.applicationName = getStringOrNull(listItem, "applicationName"); + obs.serverName = getStringOrNull(listItem, "serverName"); + obs.environment = getStringOrNull(listItem, "deploymentTier"); + return obs; + } + + private void addDetailsToObservation(Observation obs, JsonObject details) { + if (details.has("stackTrace") && !details.get("stackTrace").isJsonNull()) { + JsonElement stackTraceElement = details.get("stackTrace"); + if (stackTraceElement.isJsonArray()) { + JsonArray stackTrace = stackTraceElement.getAsJsonArray(); + StringBuilder sb = new StringBuilder(); + for (JsonElement frame : stackTrace) { + if (sb.length() > 0) sb.append("\n"); + sb.append(frame.getAsString()); + } + obs.stackTrace = sb.toString(); + } else if (stackTraceElement.isJsonPrimitive()) { + obs.stackTrace = stackTraceElement.getAsString(); + } + } + } + + private String getStringOrNull(JsonObject obj, String key) { + if (obj.has(key) && !obj.get(key).isJsonNull()) { + return obj.get(key).getAsString(); + } + return null; + } + + public void listApplications(List observations) { + Map appIdToName = new HashMap<>(); + Map appIdToCount = new HashMap<>(); + + for (Observation obs : observations) { + if (obs.applicationId != null && !obs.applicationId.isEmpty()) { + appIdToName.put(obs.applicationId, obs.applicationName); + appIdToCount.merge(obs.applicationId, 1, Integer::sum); + } + } + + System.out.println("\nAvailable applications:"); + System.out.println(" ID Name Observations"); + System.out.println(" ---------------------------------------- -------------------------------------------------------- ------------"); + for (Map.Entry entry : appIdToName.entrySet()) { + String appId = entry.getKey(); + String appName = entry.getValue(); + int count = appIdToCount.get(appId); + System.out.printf(" %-40s %-56s %d%n", appId, appName, count); + } + } + + static class BlueprintResult { + JsonObject document; + String resolvedAppName; + BlueprintResult(JsonObject document, String resolvedAppName) { + this.document = document; + this.resolvedAppName = resolvedAppName; + } + } + + public BlueprintResult generateBlueprint(List observations, String appFilter) { + System.out.println("\nGenerating Blueprint" + (appFilter != null ? " for " + appFilter : " for all applications")); + + List filtered = new ArrayList<>(); + String resolvedAppName = null; + for (Observation obs : observations) { + if (appFilter == null) { + filtered.add(obs); + } else if (appFilter.equals(obs.applicationId) || appFilter.equals(obs.applicationName)) { + filtered.add(obs); + if (resolvedAppName == null && obs.applicationName != null) { + resolvedAppName = obs.applicationName; + } + } + } + System.out.println(" Processing " + filtered.size() + " observations"); + + // Group observations by app + Map> byApp = new HashMap<>(); + Map appIdToName = new HashMap<>(); + Map appIdToEnv = new HashMap<>(); + for (Observation obs : filtered) { + String appKey = obs.applicationId != null ? obs.applicationId : obs.applicationName; + if (appKey == null) continue; + byApp.computeIfAbsent(appKey, k -> new ArrayList<>()).add(obs); + appIdToName.put(appKey, obs.applicationName); + if (obs.environment != null) { + appIdToEnv.putIfAbsent(appKey, obs.environment); + } + } + + System.out.println(" Found " + byApp.size() + " applications"); + + JsonObject doc = new JsonObject(); + doc.addProperty("$schema", "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json"); + doc.addProperty("specFormat", "CycloneDX"); + doc.addProperty("specVersion", "2.0"); + doc.addProperty("serialNumber", "urn:uuid:" + UUID.randomUUID().toString()); + doc.addProperty("version", 1); + + JsonObject metadata = new JsonObject(); + metadata.addProperty("timestamp", new Date().toInstant().toString()); + doc.add("metadata", metadata); + + JsonArray blueprints = new JsonArray(); + JsonObject blueprint = new JsonObject(); + blueprint.addProperty("bom-ref", "blueprint-1"); + blueprint.addProperty("name", resolvedAppName != null ? "Blueprint - " + resolvedAppName + : (appFilter != null ? "Blueprint - " + appFilter : "Contrast Architecture Blueprint")); + blueprint.addProperty("description", + "Generated from Contrast runtime observability data: application architecture/connections " + + "(contrast-graph) and crypto/AI usage observations, mapped onto the CycloneDX behavior " + + "taxonomy. Does not include threats, controls, or risks - see TM-BOM."); + JsonArray modelTypes = new JsonArray(); + modelTypes.add("architecture"); + modelTypes.add("behavioral"); + blueprint.add("modelTypes", modelTypes); + + // --- Assets: one per known application, plus one per distinct connected entity we + // only know by name (no architecture-graph node of our own for it). --- + Map appAssetRefs = new HashMap<>(); // appId -> asset bom-ref + Map nameToAssetRef = new HashMap<>(); // application/connection name -> asset bom-ref + JsonArray assets = new JsonArray(); + + for (Map.Entry> entry : byApp.entrySet()) { + String appId = entry.getKey(); + String appName = appIdToName.get(appId); + String displayName = appName != null ? appName : appId; + String assetRef = "asset-app-" + sanitizeBomRef(displayName); + appAssetRefs.put(appId, assetRef); + nameToAssetRef.put(displayName, assetRef); + + JsonObject asset = new JsonObject(); + asset.addProperty("bom-ref", assetRef); + asset.addProperty("name", displayName); + asset.addProperty("type", "system"); + + AppGraphInfo graphInfo = appGraphInfo.get(appId); + JsonArray assetProps = new JsonArray(); + if (graphInfo != null) { + if (graphInfo.language != null) { + assetProps.add(property("contrast:language", graphInfo.language)); + } + if (graphInfo.postureScore != null) { + assetProps.add(property("contrast:postureScore", String.valueOf(graphInfo.postureScore))); + } + if (graphInfo.postureSeverity != null) { + assetProps.add(property("contrast:postureSeverity", graphInfo.postureSeverity)); + } + if (graphInfo.openIssuesTotal != null) { + assetProps.add(property("contrast:openIssuesTotal", String.valueOf(graphInfo.openIssuesTotal))); + } + assetProps.add(property("contrast:serverCount", String.valueOf(graphInfo.serverCount))); + assetProps.add(property("contrast:libraryCount", String.valueOf(graphInfo.libraryCount))); + + if (graphInfo.criticality != null) { + JsonObject classification = new JsonObject(); + classification.addProperty("criticality", mapCriticality(graphInfo.criticality)); + asset.add("classification", classification); + } + } + if (assetProps.size() > 0) { + asset.add("properties", assetProps); + } + + String env = appIdToEnv.get(appId); + if (env != null) { + asset.addProperty("zone", "zone-env-" + sanitizeBomRef(env)); + } + + assets.add(asset); + } + + // External assets: connections whose target isn't one of our known applications + // (resolved by applicationId first, falling back to name matching - the + // contrast-graph display name for an app doesn't always match its /observations + // applicationName, so name-only matching would otherwise fabricate duplicates of + // apps we already have an asset for). + int externalCounter = 0; + for (AppGraphInfo graphInfo : appGraphInfo.values()) { + for (String connectedName : graphInfo.connectedApplications) { + if (resolveConnectedAssetRef(graphInfo, connectedName, appAssetRefs, nameToAssetRef) == null) { + String assetRef = "asset-external-" + sanitizeBomRef(connectedName); + nameToAssetRef.put(connectedName, assetRef); + + JsonObject asset = new JsonObject(); + asset.addProperty("bom-ref", assetRef); + asset.addProperty("name", connectedName); + asset.addProperty("type", "system"); + asset.addProperty("description", "Known only as an architecture-graph connection target; no application-level data available."); + assets.add(asset); + externalCounter++; + } + } + } + blueprint.add("assets", assets); + + // --- Zones: one per deployment tier seen --- + JsonArray zones = new JsonArray(); + Set envsSeen = new HashSet<>(appIdToEnv.values()); + for (String env : envsSeen) { + JsonObject zone = new JsonObject(); + zone.addProperty("bom-ref", "zone-env-" + sanitizeBomRef(env)); + zone.addProperty("name", env); + zone.addProperty("type", "deployment"); + zones.add(zone); + } + blueprint.add("zones", zones); + + // --- Flows: architecture-graph connections between assets (direction is not + // preserved by the graph API, so flows are modeled as bidirectional) --- + JsonArray flows = new JsonArray(); + Set seenPairs = new HashSet<>(); + int flowCounter = 0; + for (Map.Entry entry : appGraphInfo.entrySet()) { + String appId = entry.getKey(); + String sourceRef = appAssetRefs.get(appId); + if (sourceRef == null) continue; // app filtered out / not in this blueprint + + for (String connectedName : entry.getValue().connectedApplications) { + String destRef = resolveConnectedAssetRef(entry.getValue(), connectedName, appAssetRefs, nameToAssetRef); + if (destRef == null || destRef.equals(sourceRef)) continue; + + String pairKey = sourceRef.compareTo(destRef) < 0 ? sourceRef + "|" + destRef : destRef + "|" + sourceRef; + if (!seenPairs.add(pairKey)) continue; + + JsonObject flow = new JsonObject(); + flow.addProperty("bom-ref", "flow-" + (++flowCounter)); + flow.addProperty("name", appIdToName.getOrDefault(appId, appId) + " <-> " + connectedName); + flow.addProperty("type", "data"); + flow.addProperty("source", sourceRef); + flow.addProperty("destination", destRef); + flow.addProperty("bidirectional", true); + flows.add(flow); + } + } + blueprint.add("flows", flows); + + // --- Behaviors: crypto/AI usage observations mapped onto the behavior taxonomy --- + // TODO: the Behavior tab's richer per-route data (Contrast's ServiceResourceDto/ + // ActionType model - resources as addressable assets with per-resource actions like + // AUTHN, STORAGE_QUERY, OUTBOUND_SERVICE_CALL) isn't reachable here. Its backend + // (adr-contrastgraph-reader's BehaviorTabController, proxied via adr-explorer-aggregator) + // has no API-Key-authenticated route in contrast-api-gateway - only UI session/XSRF auth + // works today. Revisit once that gap is closed (see PROD-2415). + JsonArray instances = new JsonArray(); + int behaviorCounter = 0; + int unmapped = 0; + for (Observation obs : filtered) { + String appKey = obs.applicationId != null ? obs.applicationId : obs.applicationName; + String actorRef = appKey != null ? appAssetRefs.get(appKey) : null; + + String tag = "crypto".equals(obs.kind) ? mapCryptoBehavior(obs.algorithm) : mapAiBehavior(); + if (tag == null) { + unmapped++; + continue; + } + + JsonObject instance = new JsonObject(); + instance.addProperty("bom-ref", "behavior-" + (++behaviorCounter)); + instance.addProperty("behavior", tag); + if (actorRef != null) { + JsonArray actors = new JsonArray(); + actors.add(actorRef); + instance.add("actors", actors); + } + instance.addProperty("trigger", obs.route != null ? "api-call" : "unknown"); + instances.add(instance); + } + if (unmapped > 0) { + System.out.println(" " + unmapped + " observation(s) had no behavior-taxonomy mapping, skipped"); + } + JsonObject behaviors = new JsonObject(); + behaviors.add("instances", instances); + blueprint.add("behaviors", behaviors); + + blueprints.add(blueprint); + doc.add("blueprints", blueprints); + + System.out.println(" Created " + assets.size() + " assets (" + externalCounter + " external), " + + zones.size() + " zones, " + flows.size() + " flows, " + instances.size() + " behavior instances"); + + return new BlueprintResult(doc, resolvedAppName); + } + + /** + * Maps a Contrast crypto-algorithm observation onto an entry in the CycloneDX behavior + * taxonomy (behavior-taxonomy.schema.json, security:cryptography:* namespace), based on + * the algorithm's cryptographic primitive. This is necessarily a coarse mapping: the + * taxonomy distinguishes e.g. encrypt vs. decrypt, but a crypto-algorithm observation + * doesn't tell us which direction was used, so a representative tag is chosen per primitive. + */ + private String mapCryptoBehavior(String algorithm) { + if (algorithm == null || algorithm.isEmpty()) return null; + AlgorithmParser parser = new AlgorithmParser(algorithm); + String primitive = parser.getPrimitive(); + if (primitive == null) return "security:cryptography:encryptsData"; + + switch (primitive.toLowerCase()) { + case "ae": + case "block-cipher": + case "stream-cipher": + case "pke": + return "security:cryptography:encryptsData"; + case "hash": + case "xof": + return "security:cryptography:hashesData"; + case "mac": + return "security:cryptography:ensuresIntegrity"; + case "signature": + return "security:cryptography:signsData"; + case "kex": + case "key-agree": + case "kem": + return "security:cryptography:exchangesKey"; + case "kdf": + return "security:cryptography:generatesKey"; + case "drbg": + return "security:cryptography:generatesRandomValue"; + default: + return "security:cryptography:encryptsData"; + } + } + + /** + * AI-usage observations don't distinguish inference/training/agent action types, so all + * are mapped onto the taxonomy's general-purpose generative-AI-call entry. + */ + private String mapAiBehavior() { + return "ai:generative:processesPrompt"; + } + + /** + * Resolves an architecture-graph connection name to the asset bom-ref it actually + * refers to. Prefers resolving by applicationId (via AppGraphInfo.connectedApplicationIds) + * when the connection target is itself a known Contrast application, since the + * contrast-graph display name and the /observations applicationName for the same app + * can differ; falls back to matching on the name string (for server/library clusters, + * or apps outside this blueprint's filter). + */ + private String resolveConnectedAssetRef(AppGraphInfo graphInfo, String connectedName, + Map appAssetRefs, Map nameToAssetRef) { + String connectedAppId = graphInfo.connectedApplicationIds.get(connectedName); + if (connectedAppId != null) { + String ref = appAssetRefs.get(connectedAppId); + if (ref != null) return ref; + } + return nameToAssetRef.get(connectedName); + } + + private String mapCriticality(int criticality) { + if (criticality <= 1) return "minimal"; + if (criticality == 2) return "low"; + if (criticality == 3) return "moderate"; + if (criticality == 4) return "high"; + return "critical"; + } + + private JsonObject property(String name, String value) { + JsonObject p = new JsonObject(); + p.addProperty("name", name); + p.addProperty("value", value); + return p; + } + + private String sanitizeBomRef(String input) { + return input.toLowerCase() + .replaceAll("[^a-z0-9-]", "-") + .replaceAll("-+", "-") + .replaceAll("^-|-$", ""); + } + + public void writeBlueprint(JsonObject document, String filename) throws IOException { + System.out.println("\nWriting Blueprint to " + filename); + + String json = prettyGson.toJson(document); + try (FileWriter writer = new FileWriter(filename)) { + writer.write(json); + } + + System.out.println(" Done!"); + System.out.println("\n Output: " + filename); + } + + // Observation class for holding fetched data (crypto or AI usage) + static class Observation { + String id; + String kind; // "crypto" or "ai" + String algorithm; // crypto only + String provider; // ai only + String model; // ai only + String eventTime; + String route; + String applicationId; + String applicationName; + String serverName; + String environment; + String stackTrace; + } +} diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/Main.java b/src/main/java/com/contrastsecurity/runtimeanalyst/Main.java index 78ea4c8..bda54c9 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/Main.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/Main.java @@ -34,12 +34,23 @@ public static void main(String[] args) { ensureAuthenticated(rest); AIBOMGenerator.main(rest); break; + case "blueprint": + ensureAuthenticated(rest); + BlueprintGenerator.main(rest); + break; + case "vex": + ensureAuthenticated(rest); + VEXGenerator.main(rest); + break; case "cbom-advisor": QuantumAdvisor.main(rest); break; case "aibom-advisor": AIAdvisor.main(rest); break; + case "vex-advisor": + VEXAdvisor.main(rest); + break; case "--help": case "-h": printUsage(); @@ -80,10 +91,13 @@ private static void printUsage() { System.out.println(" java -jar runtime-analyst.jar auth [options] Connect to Contrast and generate contrast.properties"); System.out.println(" java -jar runtime-analyst.jar cbom [options] Generate a Cryptography Bill of Materials"); System.out.println(" java -jar runtime-analyst.jar aibom [options] Generate an AI/LLM usage Bill of Materials"); + System.out.println(" java -jar runtime-analyst.jar blueprint [options] Generate a CycloneDX Blueprint (ABOM + Bill of Behaviors)"); + System.out.println(" java -jar runtime-analyst.jar vex [options] Generate a CycloneDX VEX from library-usage and CVE Shield data"); System.out.println(" java -jar runtime-analyst.jar cbom-advisor Re-run the Quantum Advisor against an existing CBOM"); System.out.println(" java -jar runtime-analyst.jar aibom-advisor Re-run the AI Advisor against an existing AI-BOM"); - System.out.println("\n`cbom --analyze` / `aibom --analyze` already run the matching advisor automatically after generation -"); - System.out.println("the standalone cbom-advisor/aibom-advisor commands are for re-running the advisor without regenerating the BOM."); + System.out.println(" java -jar runtime-analyst.jar vex-advisor Re-run the VEX Advisor against an existing VEX"); + System.out.println("\n`cbom --analyze` / `aibom --analyze` / `vex --analyze` already run the matching advisor automatically after"); + System.out.println("generation - the standalone *-advisor commands are for re-running the advisor without regenerating the file."); System.out.println("\nRun with -h after a subcommand for its options, e.g.:"); System.out.println(" java -jar runtime-analyst.jar cbom -h"); System.out.println(" java -jar runtime-analyst.jar aibom -h"); diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java new file mode 100644 index 0000000..b31e9db --- /dev/null +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -0,0 +1,498 @@ +package com.contrastsecurity.runtimeanalyst; + +import java.io.FileReader; +import java.io.FileWriter; +import java.io.IOException; +import java.time.LocalDateTime; +import java.time.format.DateTimeFormatter; +import java.util.ArrayList; +import java.util.Comparator; +import java.util.LinkedHashMap; +import java.util.List; +import java.util.Map; + +import com.google.gson.Gson; +import com.google.gson.GsonBuilder; +import com.google.gson.JsonArray; +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +/** + * AI-powered review of a CycloneDX VEX document produced by VEXGenerator - not a second + * opinion on whether the CVE exists (Contrast's runtime data already establishes that), + * but a sanity check on whether each "not_affected"/"in_triage" CLAIM is well-supported + * given the CVE's severity/exploitability, or whether a human should look at it before + * relying on it. + * + * Usage: + * java -jar runtime-analyst.jar vex-advisor vex.json [-v] [-o report.md] [--json out.json] [--no-confirm] + */ +public class VEXAdvisor { + + private static final String ANALYSIS_PROMPT = + "You are an application security analyst reviewing a set of VEX (Vulnerability Exploitability eXchange) " + + "claims that a tool generated automatically from Contrast Security runtime observability data, for ONE " + + "application.\n\n" + + "Each claim already has a CycloneDX analysis.state (not_affected or in_triage) and a justification/detail " + + "explaining WHY the tool made that claim (e.g. the library's classes were never loaded at runtime, or the " + + "vulnerable code path hasn't executed in N days of observation). Your job is NOT to re-derive the CVE - it " + + "is to judge whether relying on each claim, as stated, is reasonable given the CVE's severity/exploitability, " + + "or whether it's the kind of claim a human reviewer should double-check before trusting it.\n\n" + + "## What makes a claim worth flagging for review\n\n" + + "- A `not_affected` claim justified only by \"N days without observed execution\" (not by code_not_reachable " + + "or protected_at_runtime) on a CRITICAL/HIGH severity CVE, especially one with a high EPSS score or KEV " + + "(known-exploited) status - absence of evidence is weaker evidence the more severe/exploitable the CVE is.\n" + + "- An `in_triage` claim on a CRITICAL/HIGH severity CVE with very few days observed so far - not wrong, but " + + "worth surfacing as still-open risk rather than letting it sit silently.\n" + + "- Anything where the day count looks barely over the acceptance threshold rather than comfortably past it.\n\n" + + "## What's normally fine as-is\n\n" + + "- `code_not_reachable` (zero classes of the library ever loaded) - this is a structural fact, not a " + + "probabilistic one, regardless of severity.\n" + + "- `protected_at_runtime` (CVE Shield/Protect actively mitigating) - an active control, not an absence of " + + "evidence.\n" + + "- Low/medium severity CVEs accepted on duration alone - lower stakes if the absence-of-evidence reasoning " + + "turns out wrong.\n\n" + + "## Your Task - Output\n\n" + + "Return JSON:\n" + + "```json\n" + + "{\n" + + " \"application_description\": \"2-3 sentence overview of this application's VEX posture - how many claims, \"\n" + + " + \"how sound they generally look\",\n" + + " \"risk_level\": \"CRITICAL|HIGH|MEDIUM|LOW|SOUND\",\n" + + " \"risk_rationale\": \"Why this level, referencing the specific claims that drove it\",\n" + + " \"recommendation\": \"Specific next action - e.g. which CVEs need a human look before relying on this VEX\",\n" + + " \"statements\": [\n" + + " {\n" + + " \"cve_id\": \"CVE ID exactly as given\",\n" + + " \"assessment\": \"sound|needs_review\",\n" + + " \"rationale\": \"1-2 sentences on why this specific claim is or isn't safe to rely on as-is\"\n" + + " }\n" + + " ]\n" + + "}\n" + + "```\n\n" + + "Include exactly one entry in \"statements\" for each claim given below, keyed by its CVE ID.\n"; + + static class VexStatement { + String cveId; + String purl; + Double score; + String severity; + String state; + String justification; + String detail; + long classesUsed; + long classCount; + long daysObserved; + long acceptAfterDays; + } + + static class AppEntry { + String name; + List statements = new ArrayList<>(); + } + + private final Gson gson = new GsonBuilder().setPrettyPrinting().create(); + + public static void main(String[] args) { + String vexPath = null; + boolean verbose = false; + String output = null; + String jsonOut = null; + boolean noConfirm = false; + + for (int i = 0; i < args.length; i++) { + String a = args[i]; + if (a.equals("-v") || a.equals("--verbose")) verbose = true; + else if ((a.equals("-o") || a.equals("--output")) && i + 1 < args.length) output = args[++i]; + else if (a.equals("--json") && i + 1 < args.length) jsonOut = args[++i]; + else if (a.equals("--no-confirm")) noConfirm = true; + else if (a.equals("-h") || a.equals("--help")) { + System.out.println("Usage: java -jar runtime-analyst.jar vex-advisor [-v] [-o report.md] [--json out.json] [--no-confirm]"); + return; + } else if (!a.startsWith("-")) { + vexPath = a; + } + } + + if (vexPath == null) { + System.err.println("Error: path to VEX JSON file is required"); + System.exit(1); + } + + try { + new VEXAdvisor().run(vexPath, verbose, output, jsonOut, noConfirm); + } catch (Exception e) { + System.err.println("Error: " + e.getMessage()); + e.printStackTrace(); + System.exit(1); + } + } + + private void run(String vexPath, boolean verbose, String output, String jsonOut, boolean noConfirm) throws Exception { + System.out.println("\nParsing VEX..."); + List entries = parseVex(vexPath); + + int totalStatements = 0; + for (AppEntry e : entries) totalStatements += e.statements.size(); + System.out.println(" Found " + entries.size() + " application(s) with " + totalStatements + " VEX statement(s)"); + + if (entries.isEmpty()) { + System.out.println("\nNo VEX statements found!"); + return; + } + + ClaudeClient client = new ClaudeClient(); + double estimatedCost = client.estimateCost(entries.size(), 2000, 800); + if (!ClaudeClient.confirmCost(estimatedCost, entries.size(), noConfirm)) { + System.out.println("Cancelled."); + return; + } + + System.out.println("\nAnalyzing " + entries.size() + " application(s)..."); + List results = new ArrayList<>(); + for (AppEntry entry : entries) { + JsonObject result; + try { + result = analyzeApplication(client, entry, verbose); + } catch (Exception e) { + System.out.println(" Error analyzing " + entry.name + ": " + e.getMessage()); + result = new JsonObject(); + result.addProperty("application", entry.name); + result.addProperty("risk_level", "ERROR"); + result.addProperty("application_description", String.valueOf(e.getMessage())); + result.add("statements", new JsonArray()); + } + results.add(result); + String risk = getString(result, "risk_level", "UNKNOWN"); + System.out.println(" [" + risk + "] " + entry.name + " (" + entry.statements.size() + " statement(s))"); + } + + int written = writeAssessmentsToVex(vexPath, results); + if (written > 0) { + System.out.println(" Wrote " + written + " assessment(s) back into " + vexPath); + } + + String report = generateReport(results, entries); + + if (output != null) { + try (FileWriter w = new FileWriter(output)) { + w.write(report); + } + System.out.println("\nReport written to " + output); + } else { + System.out.println("\n" + "=".repeat(60)); + System.out.println(report); + } + + if (jsonOut != null) { + JsonArray arr = new JsonArray(); + for (JsonObject r : results) arr.add(r); + try (FileWriter w = new FileWriter(jsonOut)) { + w.write(gson.toJson(arr)); + } + System.out.println("\nJSON results written to " + jsonOut); + } + + client.printSummary(); + } + + // ---- Parsing ---- + + private List parseVex(String path) throws IOException { + JsonObject vex; + try (FileReader reader = new FileReader(path)) { + vex = gson.fromJson(reader, JsonObject.class); + } + + Map byApp = new LinkedHashMap<>(); + JsonArray vulnerabilities = vex.has("vulnerabilities") ? vex.getAsJsonArray("vulnerabilities") : new JsonArray(); + + for (JsonElement el : vulnerabilities) { + JsonObject v = el.getAsJsonObject(); + Map props = properties(v); + String appName = props.getOrDefault("contrast:appName", "Unknown Application"); + + VexStatement s = new VexStatement(); + s.cveId = getString(v, "id", ""); + if (v.has("affects") && v.getAsJsonArray("affects").size() > 0) { + s.purl = getString(v.getAsJsonArray("affects").get(0).getAsJsonObject(), "ref", null); + } + if (v.has("ratings") && v.getAsJsonArray("ratings").size() > 0) { + JsonObject rating = v.getAsJsonArray("ratings").get(0).getAsJsonObject(); + if (rating.has("score") && !rating.get("score").isJsonNull()) s.score = rating.get("score").getAsDouble(); + s.severity = getString(rating, "severity", null); + } + if (v.has("analysis")) { + JsonObject analysis = v.getAsJsonObject("analysis"); + s.state = getString(analysis, "state", null); + s.justification = getString(analysis, "justification", null); + s.detail = getString(analysis, "detail", null); + } + s.classesUsed = parseLong(props.get("contrast:classesUsed")); + s.classCount = parseLong(props.get("contrast:classCount")); + s.daysObserved = parseLong(props.get("contrast:daysObserved")); + s.acceptAfterDays = parseLong(props.get("contrast:acceptAfterDays")); + + byApp.computeIfAbsent(appName, k -> { + AppEntry e = new AppEntry(); + e.name = k; + return e; + }).statements.add(s); + } + + return new ArrayList<>(byApp.values()); + } + + private long parseLong(String s) { + if (s == null || s.isEmpty()) return 0L; + try { + return Long.parseLong(s); + } catch (NumberFormatException e) { + return 0L; + } + } + + private Map properties(JsonObject component) { + Map props = new LinkedHashMap<>(); + if (component.has("properties")) { + for (JsonElement el : component.getAsJsonArray("properties")) { + JsonObject p = el.getAsJsonObject(); + props.put(p.get("name").getAsString(), p.get("value").getAsString()); + } + } + return props; + } + + private String getString(JsonObject obj, String key, String def) { + return obj.has(key) && !obj.get(key).isJsonNull() ? obj.get(key).getAsString() : def; + } + + // ---- AI analysis ---- + + private String formatAppForAi(AppEntry entry) { + StringBuilder sb = new StringBuilder(); + sb.append("Application: ").append(entry.name).append("\n\n"); + sb.append("VEX Claims:"); + + for (VexStatement s : entry.statements) { + sb.append("\n\n--- ").append(s.cveId).append(" ---\n"); + sb.append("Library: ").append(s.purl != null ? s.purl : "unknown").append("\n"); + sb.append("Severity: ").append(s.severity != null ? s.severity : "unknown") + .append(s.score != null ? " (score " + s.score + ")" : "").append("\n"); + sb.append("Claimed state: ").append(s.state).append("\n"); + if (s.justification != null) sb.append("Justification: ").append(s.justification).append("\n"); + sb.append("Detail: ").append(s.detail != null ? s.detail : "(none)").append("\n"); + sb.append("Classes used: ").append(s.classesUsed).append(" of ").append(s.classCount).append("\n"); + sb.append("Days observed: ").append(s.daysObserved).append(" (acceptance threshold: ").append(s.acceptAfterDays).append(")\n"); + } + + return sb.toString(); + } + + private JsonObject analyzeApplication(ClaudeClient client, AppEntry entry, boolean verbose) throws Exception { + String entryText = formatAppForAi(entry); + if (verbose) System.out.println(" Analyzing " + entry.name + " (" + entry.statements.size() + " VEX statements)..."); + + String response = client.call(ANALYSIS_PROMPT, entryText, null); + + int start = response.indexOf('{'); + int end = response.lastIndexOf('}'); + if (start >= 0 && end > start) { + try { + JsonObject result = gson.fromJson(response.substring(start, end + 1), JsonObject.class); + result.addProperty("application", entry.name); + return result; + } catch (Exception ignored) { + // fall through to fallback below + } + } + + JsonObject fallback = new JsonObject(); + fallback.addProperty("application", entry.name); + fallback.addProperty("risk_level", "UNKNOWN"); + fallback.addProperty("application_description", "Failed to parse AI response"); + fallback.addProperty("recommendation", response.length() > 500 ? response.substring(0, 500) : response); + fallback.add("statements", new JsonArray()); + return fallback; + } + + private int writeAssessmentsToVex(String vexPath, List results) throws IOException { + Map> assessmentsByAppAndCve = new LinkedHashMap<>(); + for (JsonObject r : results) { + String app = getString(r, "application", null); + if (app == null || !r.has("statements")) continue; + Map byCve = new LinkedHashMap<>(); + for (JsonElement el : r.getAsJsonArray("statements")) { + JsonObject s = el.getAsJsonObject(); + String cveId = getString(s, "cve_id", null); + if (cveId != null) byCve.put(cveId, s); + } + assessmentsByAppAndCve.put(app, byCve); + } + + JsonObject vex; + try (FileReader reader = new FileReader(vexPath)) { + vex = gson.fromJson(reader, JsonObject.class); + } + + int written = 0; + JsonArray vulnerabilities = vex.has("vulnerabilities") ? vex.getAsJsonArray("vulnerabilities") : new JsonArray(); + for (JsonElement el : vulnerabilities) { + JsonObject v = el.getAsJsonObject(); + Map props = properties(v); + String appName = props.getOrDefault("contrast:appName", "Unknown Application"); + String cveId = getString(v, "id", null); + + Map byCve = assessmentsByAppAndCve.get(appName); + if (byCve == null || cveId == null || !byCve.containsKey(cveId)) continue; + + JsonObject assessment = byCve.get(cveId); + JsonArray properties = v.has("properties") ? v.getAsJsonArray("properties") : new JsonArray(); + properties.add(propertyJson("contrast:vexAdvisorAssessment", getString(assessment, "assessment", "unknown"))); + properties.add(propertyJson("contrast:vexAdvisorRationale", getString(assessment, "rationale", ""))); + v.add("properties", properties); + written++; + } + + if (written > 0) { + try (FileWriter w = new FileWriter(vexPath)) { + w.write(gson.toJson(vex)); + } + } + + return written; + } + + private JsonObject propertyJson(String name, String value) { + JsonObject p = new JsonObject(); + p.addProperty("name", name); + p.addProperty("value", value != null ? value : ""); + return p; + } + + // ---- Report generation ---- + + private String generateReport(List appResults, List entries) { + String reportDate = LocalDateTime.now().format(DateTimeFormatter.ofPattern("MMMM d, yyyy")); + + Map entriesByName = new LinkedHashMap<>(); + for (AppEntry e : entries) entriesByName.put(e.name, e); + + Map riskCounts = new LinkedHashMap<>(); + Map riskByApp = new LinkedHashMap<>(); + for (JsonObject r : appResults) { + String level = getString(r, "risk_level", "UNKNOWN"); + riskCounts.merge(level, 1, Integer::sum); + String app = getString(r, "application", null); + if (app != null) riskByApp.put(app, level); + } + + int totalApps = appResults.size(); + int totalStatements = 0; + int needsReviewCount = 0; + for (AppEntry e : entries) totalStatements += e.statements.size(); + for (JsonObject r : appResults) { + if (!r.has("statements")) continue; + for (JsonElement el : r.getAsJsonArray("statements")) { + if ("needs_review".equals(getString(el.getAsJsonObject(), "assessment", ""))) needsReviewCount++; + } + } + + StringBuilder sb = new StringBuilder(); + sb.append("\n\n"); + sb.append("# Contrast VEX Advisor\n## Review of Automatically-Generated VEX Claims\n\n---\n\n"); + sb.append("**Report Date:** ").append(reportDate).append("\n"); + sb.append("**Assessment Type:** VEX Claim Soundness Review\n\n---\n\n"); + sb.append("## Executive Summary\n\n"); + sb.append("This report reviews VEX (Vulnerability Exploitability eXchange) claims generated from Contrast ") + .append("Security runtime library-usage and CVE Shield/Protect data. It does not re-derive whether a CVE ") + .append("exists - it judges whether each `not_affected`/`in_triage` claim is well-supported enough to rely ") + .append("on as-is, or whether a human should look at it first.\n\n"); + sb.append("**").append(totalApps).append("** application(s), **").append(totalStatements) + .append("** VEX statement(s) reviewed.\n\n"); + + if (needsReviewCount > 0) { + sb.append("> **").append(needsReviewCount).append(" claim(s) flagged for human review** before relying on them.\n"); + } else { + sb.append("> No claims were flagged for review - all VEX statements look well-supported as generated.\n"); + } + + sb.append("\n### Applications\n\n| Application | Risk Level | Statements |\n|-------------|------------|------------|\n"); + for (AppEntry e : entries) { + sb.append("| ").append(e.name).append(" | ").append(riskByApp.getOrDefault(e.name, "UNKNOWN")) + .append(" | ").append(e.statements.size()).append(" |\n"); + } + + sb.append("\n| Risk Level | Applications |\n|------------|--------------|\n"); + for (String level : new String[]{"CRITICAL", "HIGH", "MEDIUM", "LOW", "SOUND", "UNKNOWN"}) { + if (riskCounts.containsKey(level)) { + sb.append("| ").append(level).append(" | ").append(riskCounts.get(level)).append(" |\n"); + } + } + + sb.append("\n---\n\n## Application Review\n\n"); + + List order = java.util.Arrays.asList("CRITICAL", "HIGH", "MEDIUM", "LOW", "SOUND", "UNKNOWN"); + List sortedResults = new ArrayList<>(appResults); + sortedResults.sort(Comparator.comparingInt(r -> { + int idx = order.indexOf(getString(r, "risk_level", "UNKNOWN")); + return idx < 0 ? 99 : idx; + })); + + for (JsonObject r : sortedResults) { + String appName = getString(r, "application", "Unknown"); + AppEntry entry = entriesByName.get(appName); + String riskLevel = getString(r, "risk_level", "UNKNOWN"); + + sb.append("### ").append(appName).append("\n\n**Risk Level:** ").append(riskLevel).append("\n\n"); + sb.append(getString(r, "application_description", "No description available.")).append("\n\n"); + sb.append("**Risk Rationale:** ").append(getString(r, "risk_rationale", "Unknown")).append("\n\n"); + sb.append("**Recommendation:** ").append(getString(r, "recommendation", "None")).append("\n\n"); + sb.append("#### VEX Statements\n\n"); + + Map statementAssessments = new LinkedHashMap<>(); + if (r.has("statements")) { + for (JsonElement sEl : r.getAsJsonArray("statements")) { + JsonObject s = sEl.getAsJsonObject(); + statementAssessments.put(getString(s, "cve_id", ""), s); + } + } + + if (entry != null) { + sb.append("| CVE | Library | Severity | State | Assessment |\n|-----|---------|----------|-------|------------|\n"); + for (VexStatement s : entry.statements) { + JsonObject assessment = statementAssessments.get(s.cveId); + String assessLabel = assessment != null ? getString(assessment, "assessment", "unknown") : "unknown"; + sb.append("| ").append(s.cveId).append(" | `").append(s.purl != null ? s.purl : "unknown") + .append("` | ").append(s.severity != null ? s.severity : "unknown").append(" | ") + .append(s.state).append(" | ").append(assessLabel).append(" |\n"); + } + + sb.append("\n"); + for (VexStatement s : entry.statements) { + JsonObject assessment = statementAssessments.get(s.cveId); + if (assessment == null) continue; + String rationale = getString(assessment, "rationale", null); + if (rationale == null || rationale.isEmpty()) continue; + sb.append("- **").append(s.cveId).append("** (").append(getString(assessment, "assessment", "unknown")) + .append("): ").append(rationale).append("\n"); + } + sb.append("\n"); + } + + sb.append("---\n\n"); + } + + sb.append("## Appendix: Methodology\n\n"); + sb.append("VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and ") + .append("per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This ") + .append("advisor does not change any claim; it only assesses whether relying on each claim as generated is ") + .append("reasonable given the CVE's severity and exploitability.\n\n"); + sb.append("- **sound**: the claim's justification (structural fact or active control) supports relying on it as-is\n"); + sb.append("- **needs_review**: the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or ") + .append("is otherwise borderline - a human should confirm before treating it as resolved\n\n---\n\n"); + sb.append("*Report generated by Contrast VEX Advisor*\n*Powered by Contrast Security Runtime Observability*\n"); + + return sb.toString(); + } +} diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java new file mode 100644 index 0000000..0d97d90 --- /dev/null +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java @@ -0,0 +1,631 @@ +package com.contrastsecurity.runtimeanalyst; + +import java.io.File; +import java.io.FileInputStream; +import java.io.FileWriter; +import java.io.IOException; +import java.io.InputStream; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Properties; + +import org.apache.http.HttpResponse; +import org.apache.http.client.methods.HttpGet; +import org.apache.http.client.methods.HttpPost; +import org.apache.http.entity.StringEntity; +import org.apache.http.impl.client.CloseableHttpClient; +import org.apache.http.impl.client.HttpClients; +import org.apache.http.util.EntityUtils; + +import org.cyclonedx.Version; +import org.cyclonedx.generators.BomGeneratorFactory; +import org.cyclonedx.generators.json.BomJsonGenerator; +import org.cyclonedx.model.Bom; +import org.cyclonedx.model.Component; +import org.cyclonedx.model.Metadata; +import org.cyclonedx.model.Property; +import org.cyclonedx.model.vulnerability.Vulnerability; +import org.cyclonedx.model.vulnerability.Vulnerability.Affect; +import org.cyclonedx.model.vulnerability.Vulnerability.Analysis; +import org.cyclonedx.model.vulnerability.Vulnerability.Analysis.Justification; +import org.cyclonedx.model.vulnerability.Vulnerability.Analysis.State; +import org.cyclonedx.model.vulnerability.Vulnerability.Rating; +import org.cyclonedx.model.vulnerability.Vulnerability.Rating.Method; +import org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity; +import org.cyclonedx.model.vulnerability.Vulnerability.Source; + +import com.google.gson.Gson; +import com.google.gson.JsonArray; +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +/** + * Generates a CycloneDX VEX (Vulnerability Exploitability eXchange) document for an + * application's library vulnerabilities, using Contrast's runtime library-usage and + * CVE Shield/Protect observation data to justify "not affected"/"in triage" claims + * rather than fabricating them. + * + * Three data sources, all under the same contrast.properties credentials: + * - GET /api/v4/organizations/{org}/applications app first/last seen + * - POST /Contrast/api/ng/{org}/libraries/filter per-library CVEs + runtime class-usage + * - GET /api/ns-ui/v1/organizations/{org}/applications/{id}/cves/issues per-CVE per-environment Shield/Protect status + * + * Decision rules (see CLAUDE.md discussion - these are policy, not spec): + * 1. classes_used == 0 for the app+library -> not_affected / code_not_reachable, unconditional. + * 2. classes_used > 0, CVE's env status is PROTECTING/BLOCKED -> not_affected / protected_at_runtime. + * 3. classes_used > 0, CVE's env status is EXPOSED/EXPLOITED (or unrecognized) -> no VEX entry; + * never suppress a vulnerability we can't positively account for. + * 4. classes_used > 0, CVE's env status is NOT_SEEN (or missing) in every environment observed: + * - days observed >= acceptAfterDays -> not_affected (no justification), detail explains the + * day count and threshold as an operational risk-acceptance, not a structural guarantee. + * - days observed < acceptAfterDays -> in_triage, detail explains the day count so far. + * + * Usage: + * java -jar runtime-analyst.jar vex --app "MyApp" + * java -jar runtime-analyst.jar vex --list + * java -jar runtime-analyst.jar vex --app "MyApp" --vex-accept-after-days 30 -o vex.json + */ +public class VEXGenerator { + + private static final List PROTECTED_STATUSES = List.of("PROTECTING", "BLOCKED"); + private static final List NOT_SEEN_STATUSES = List.of("NOT_SEEN"); + + private String baseUrl; // e.g. https://host/api/ns-ui/v1 + private String host; // e.g. https://host + private String orgId; + private String authHeader; + private String apiKey; + private int acceptAfterDays = 30; + private String envFilter; // DEVELOPMENT, QA, or PRODUCTION - null means consider all three + + private final Gson gson = new Gson(); + private final CloseableHttpClient httpClient = HttpClients.createDefault(); + + public VEXGenerator(String configFile) throws IOException { + loadConfig(configFile); + } + + public void setAcceptAfterDays(int days) { + this.acceptAfterDays = days; + } + + public void setEnvFilter(String env) { + this.envFilter = env; + } + + private void loadConfig(String configFile) throws IOException { + Properties props = new Properties(); + File f = configFile != null ? new File(configFile) : new File("contrast.properties"); + if (!f.exists()) { + throw new IOException("Config file not found: " + f.getPath()); + } + try (InputStream is = new FileInputStream(f)) { + props.load(is); + } + baseUrl = props.getProperty("contrast.url"); + orgId = props.getProperty("contrast.org_id"); + authHeader = props.getProperty("contrast.auth_header"); + apiKey = props.getProperty("contrast.api_key"); + if (baseUrl == null || orgId == null || authHeader == null || apiKey == null) { + throw new IOException("contrast.properties is missing one of: contrast.url, contrast.org_id, contrast.auth_header, contrast.api_key"); + } + host = baseUrl.replaceAll("/api/.*", ""); + } + + public static void main(String[] args) { + String appFilter = null; + String envFilter = null; + String outputFile = "vex.json"; + String configFile = null; + boolean listOnly = false; + boolean runAnalysis = false; + int acceptAfterDays = 30; + + for (int i = 0; i < args.length; i++) { + if ("--app".equals(args[i]) && i + 1 < args.length) { + appFilter = args[++i]; + } else if ("--env".equals(args[i]) && i + 1 < args.length) { + envFilter = args[++i].toUpperCase(); + } else if ("--list".equals(args[i])) { + listOnly = true; + } else if ("--analyze".equals(args[i])) { + runAnalysis = true; + } else if ("-o".equals(args[i]) && i + 1 < args.length) { + outputFile = args[++i]; + } else if ("-c".equals(args[i]) && i + 1 < args.length) { + configFile = args[++i]; + } else if ("--vex-accept-after-days".equals(args[i]) && i + 1 < args.length) { + acceptAfterDays = Integer.parseInt(args[++i]); + } else if ("--help".equals(args[i]) || "-h".equals(args[i])) { + printUsage(); + return; + } + } + + try { + VEXGenerator generator = new VEXGenerator(configFile); + generator.setAcceptAfterDays(acceptAfterDays); + generator.setEnvFilter(envFilter); + + List apps = generator.fetchApplications(); + + if (listOnly) { + System.out.println("\nAvailable applications:"); + for (AppInfo app : apps) { + System.out.println(" " + app.name + " (" + app.id + ")"); + } + return; + } + + List targets = new ArrayList<>(); + if (appFilter == null) { + targets.addAll(apps); + } else { + for (AppInfo app : apps) { + if (appFilter.equals(app.id) || appFilter.equalsIgnoreCase(app.name)) { + targets.add(app); + } + } + if (targets.isEmpty()) { + System.err.println("No application matched \"" + appFilter + "\". Use --list to see available applications."); + System.exit(1); + } + } + + Bom bom = generator.generateVEX(targets); + + if (appFilter != null && "vex.json".equals(outputFile)) { + String safe = targets.get(0).name.replaceAll("[^a-zA-Z0-9-_]", "_"); + outputFile = "vex-" + safe + ".json"; + } + + generator.writeVEX(bom, outputFile); + + if (runAnalysis) { + generator.runVEXAdvisor(outputFile); + } + } catch (Exception e) { + System.err.println("Error: " + e.getMessage()); + e.printStackTrace(); + System.exit(1); + } + } + + private static void printUsage() { + System.out.println("\nVEX Generator - Create a CycloneDX VEX from Contrast library-usage and CVE Shield data"); + System.out.println("\nUsage:"); + System.out.println(" java -jar runtime-analyst.jar vex --app Generate a VEX for one application"); + System.out.println(" java -jar runtime-analyst.jar vex Generate a VEX covering all applications"); + System.out.println(" java -jar runtime-analyst.jar vex --list List available applications with IDs"); + System.out.println(" java -jar runtime-analyst.jar vex --env Scope claims to one environment (DEVELOPMENT, QA, PRODUCTION) instead of this app's dev/qa/prod combined"); + System.out.println(" java -jar runtime-analyst.jar vex --vex-accept-after-days Days of no-observed-execution before treating a CVE as not_affected (default 30)"); + System.out.println(" java -jar runtime-analyst.jar vex --analyze Run VEX Advisor AI review after VEX generation"); + System.out.println(" java -jar runtime-analyst.jar vex -o Specify output filename"); + System.out.println(" java -jar runtime-analyst.jar vex -c Use custom config file"); + } + + /** + * Run the VEX Advisor to sanity-check the generated claims, in-process (no Python required). + */ + private void runVEXAdvisor(String vexFile) { + System.out.println("\n" + "=".repeat(60)); + System.out.println("Running VEX Advisor Review..."); + System.out.println("=".repeat(60)); + + String advisorOutput = vexFile.replace(".json", "-advisor.md"); + VEXAdvisor.main(new String[]{vexFile, "--no-confirm", "-o", advisorOutput}); + System.out.println("\nVEX Advisor report written to: " + advisorOutput); + } + + // ---- Data model ---- + + static class AppInfo { + String id; + String name; + long firstSeenTime; + long lastSeenTime; + } + + private static class CveIssue { + String cveId; + String libraryVersion; + String dev; + String qa; + String prod; + } + + // ---- Applications ---- + + public List fetchApplications() throws IOException { + String url = host + "/api/v4/organizations/" + orgId + "/applications?size=500"; + HttpGet get = new HttpGet(url); + get.setHeader("Authorization", authHeader); + get.setHeader("API-Key", apiKey); + get.setHeader("Accept", "application/json"); + + HttpResponse response = httpClient.execute(get); + int statusCode = response.getStatusLine().getStatusCode(); + String body = EntityUtils.toString(response.getEntity()); + if (statusCode != 200) { + throw new IOException("Applications API returned status " + statusCode + ": " + body); + } + + JsonObject json = gson.fromJson(body, JsonObject.class); + List apps = new ArrayList<>(); + for (JsonElement el : json.getAsJsonArray("content")) { + JsonObject o = el.getAsJsonObject(); + AppInfo app = new AppInfo(); + app.id = getStringOrNull(o, "id"); + app.name = getStringOrNull(o, "name"); + app.firstSeenTime = parseIsoOrEpoch(o, "firstSeenTime"); + app.lastSeenTime = parseIsoOrEpoch(o, "lastSeenTime"); + apps.add(app); + } + return apps; + } + + private long parseIsoOrEpoch(JsonObject o, String field) { + if (!o.has(field) || o.get(field).isJsonNull()) { + return 0L; + } + JsonElement el = o.get(field); + if (el.isJsonPrimitive() && el.getAsJsonPrimitive().isNumber()) { + return el.getAsLong(); + } + try { + return java.time.Instant.parse(el.getAsString()).toEpochMilli(); + } catch (Exception e) { + return 0L; + } + } + + // ---- CVE Shield / Protect status, per app ---- + + private Map fetchCveIssues(String appId) throws IOException { + Map issues = new HashMap<>(); + String cursor = ""; + boolean hasMore = true; + + while (hasMore) { + String url = baseUrl + "/organizations/" + orgId + "/applications/" + appId + + "/cves/issues?size=100&sort=cvssScore,desc&pagination=cursor&cursor=" + cursor; + HttpGet get = new HttpGet(url); + get.setHeader("Authorization", authHeader); + get.setHeader("API-Key", apiKey); + get.setHeader("Accept", "application/json"); + + HttpResponse response = httpClient.execute(get); + int statusCode = response.getStatusLine().getStatusCode(); + String body = EntityUtils.toString(response.getEntity()); + if (statusCode != 200) { + throw new IOException("CVE issues API returned status " + statusCode + ": " + body); + } + + JsonObject json = gson.fromJson(body, JsonObject.class); + for (JsonElement el : json.getAsJsonArray("items")) { + JsonObject o = el.getAsJsonObject(); + CveIssue issue = new CveIssue(); + issue.cveId = getStringOrNull(o, "cveId"); + issue.libraryVersion = getStringOrNull(o, "libraryVersion"); + issue.dev = getStringOrNull(o, "dev"); + issue.qa = getStringOrNull(o, "qa"); + issue.prod = getStringOrNull(o, "prod"); + issues.put(issue.cveId + "|" + issue.libraryVersion, issue); + } + + hasMore = json.has("hasMore") && json.get("hasMore").getAsBoolean(); + cursor = json.has("cursor") && !json.get("cursor").isJsonNull() ? json.get("cursor").getAsString() : ""; + if (cursor.isEmpty()) { + hasMore = false; + } + } + return issues; + } + + // ---- Libraries: CVEs + runtime class usage, per app ---- + + private JsonArray fetchLibraries(String appId) throws IOException { + JsonArray allLibraries = new JsonArray(); + int offset = 0; + int limit = 50; + int total = Integer.MAX_VALUE; + + while (offset < total) { + String url = host + "/Contrast/api/ng/" + orgId + + "/libraries/filter?expand=skip_links,apps,quickFilters,vulns,status,usage_counts" + + "&offset=" + offset + "&limit=" + limit + "&sort=score"; + HttpPost post = new HttpPost(url); + post.setHeader("Authorization", authHeader); + post.setHeader("API-Key", apiKey); + post.setHeader("Content-Type", "application/json"); + post.setHeader("Accept", "application/json"); + + JsonObject requestBody = new JsonObject(); + requestBody.addProperty("q", ""); + requestBody.addProperty("quickFilter", "VULNERABLE"); + JsonArray appsArray = new JsonArray(); + appsArray.add(appId); + requestBody.add("apps", appsArray); + requestBody.add("servers", new JsonArray()); + requestBody.add("environments", new JsonArray()); + requestBody.add("grades", new JsonArray()); + requestBody.add("languages", new JsonArray()); + requestBody.add("licenses", new JsonArray()); + requestBody.add("status", new JsonArray()); + requestBody.add("severities", new JsonArray()); + requestBody.add("tags", new JsonArray()); + requestBody.addProperty("includeUnused", true); + requestBody.addProperty("includeUsed", true); + post.setEntity(new StringEntity(gson.toJson(requestBody))); + + HttpResponse response = httpClient.execute(post); + int statusCode = response.getStatusLine().getStatusCode(); + String body = EntityUtils.toString(response.getEntity()); + if (statusCode != 200) { + throw new IOException("Libraries API returned status " + statusCode + ": " + body); + } + + JsonObject json = gson.fromJson(body, JsonObject.class); + JsonArray page = json.getAsJsonArray("libraries"); + for (JsonElement el : page) { + allLibraries.add(el); + } + total = json.has("count") ? json.get("count").getAsInt() : page.size(); + offset += limit; + if (page.size() == 0) { + break; + } + } + return allLibraries; + } + + // ---- VEX generation ---- + + public Bom generateVEX(List apps) throws IOException { + Bom bom = new Bom(); + List vulnerabilities = new ArrayList<>(); + + for (AppInfo app : apps) { + System.out.println("\nProcessing " + app.name + " (" + app.id + ")..."); + + Map cveIssues = fetchCveIssues(app.id); + JsonArray libraries = fetchLibraries(app.id); + System.out.println(" " + libraries.size() + " vulnerable libraries, " + cveIssues.size() + " CVE issue records"); + + long daysObserved = (app.lastSeenTime > app.firstSeenTime) + ? (app.lastSeenTime - app.firstSeenTime) / (1000L * 60 * 60 * 24) + : 0L; + + for (JsonElement libEl : libraries) { + JsonObject lib = libEl.getAsJsonObject(); + String group = getStringOrNull(lib, "group"); + String fileName = getStringOrNull(lib, "file_name"); + String fileVersion = getStringOrNull(lib, "file_version"); + String hash = getStringOrNull(lib, "hash"); + long classesUsed = lib.has("classes_used") ? lib.get("classes_used").getAsLong() : 0L; + long classCount = lib.has("class_count") ? lib.get("class_count").getAsLong() : 0L; + + if (!lib.has("vulns")) { + continue; + } + + for (JsonElement vulnEl : lib.getAsJsonArray("vulns")) { + JsonObject vuln = vulnEl.getAsJsonObject(); + String cveId = getStringOrNull(vuln, "name"); + if (cveId == null) { + continue; + } + + Vulnerability v = buildVulnerability( + app, group, fileName, fileVersion, hash, classesUsed, classCount, + cveId, vuln, cveIssues.get(cveId + "|" + fileVersion), daysObserved); + + if (v != null) { + vulnerabilities.add(v); + } + } + } + } + + System.out.println("\nGenerated " + vulnerabilities.size() + " VEX statements."); + bom.setVulnerabilities(vulnerabilities); + + if (apps.size() == 1) { + Component appComponent = new Component(); + appComponent.setType(Component.Type.APPLICATION); + appComponent.setName(apps.get(0).name); + appComponent.setBomRef(sanitizeBomRef(apps.get(0).id)); + Metadata metadata = new Metadata(); + metadata.setComponent(appComponent); + bom.setMetadata(metadata); + } + + return bom; + } + + /** Returns null when the CVE shouldn't get a VEX statement at all (exposed/exploited/unrecognized status). */ + private Vulnerability buildVulnerability(AppInfo app, String group, String fileName, String fileVersion, + String hash, long classesUsed, long classCount, String cveId, JsonObject vuln, + CveIssue issue, long daysObserved) { + + Vulnerability v = new Vulnerability(); + v.setBomRef(sanitizeBomRef(app.id + "-" + cveId + "-" + hash)); + v.setId(cveId); + + Source source = new Source(); + source.setName("NVD"); + source.setUrl("https://nvd.nist.gov/vuln/detail/" + cveId); + v.setSource(source); + + Rating rating = new Rating(); + rating.setSource(source); + if (vuln.has("cvss_3_severity_value")) { + rating.setScore(vuln.get("cvss_3_severity_value").getAsDouble()); + } + String severity = getStringOrNull(vuln, "cvss_3_severity_code"); + if (severity != null) { + rating.setSeverity(Severity.fromString(severity.toLowerCase())); + } + rating.setMethod(Method.CVSSV31); + String vector = getStringOrNull(vuln, "cvss_3_vector"); + if (vector != null) { + rating.setVector(vector); + } + List ratings = new ArrayList<>(); + ratings.add(rating); + v.setRatings(ratings); + + String purl = "pkg:maven/" + (group != null ? group : "unknown") + "/" + artifactNameFrom(fileName) + "@" + fileVersion; + Affect affect = new Affect(); + affect.setRef(purl); + List affects = new ArrayList<>(); + affects.add(affect); + v.setAffects(affects); + + Analysis analysis = new Analysis(); + String detail; + + if (classesUsed == 0) { + analysis.setState(State.NOT_AFFECTED); + analysis.setJustification(Justification.CODE_NOT_REACHABLE); + detail = "Library not observed executing at runtime in " + app.name + " - 0 of " + classCount + + " classes loaded (Contrast runtime library-usage data)."; + } else if (issue != null && isProtected(issue)) { + analysis.setState(State.NOT_AFFECTED); + analysis.setJustification(Justification.PROTECTED_AT_RUNTIME); + detail = "CVE Shield/Protect is actively mitigating this vulnerability at runtime in " + app.name + + " (" + envScopeLabel() + ")."; + } else if (issue != null && isNotSeen(issue)) { + detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used) but this CVE's " + + "vulnerable code path has not been observed executing in " + app.name + " (" + envScopeLabel() + + ") in " + daysObserved + " days of runtime monitoring"; + if (daysObserved >= acceptAfterDays) { + analysis.setState(State.NOT_AFFECTED); + detail += " (policy threshold: " + acceptAfterDays + " days). Operational risk acceptance based on " + + "runtime observation, not a structural non-reachability guarantee."; + } else { + analysis.setState(State.IN_TRIAGE); + detail += " (below the " + acceptAfterDays + "-day acceptance threshold)."; + } + } else if (issue == null) { + // Library confirmed used, but no matching per-CVE environment record found at all - + // treat the same as "not seen" using the same duration logic, but flag the missing join. + detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used); no per-environment " + + "CVE Shield/exposure record found for this CVE+version in " + app.name + ". Not observed " + + "executing in " + daysObserved + " days of runtime monitoring for this application"; + if (daysObserved >= acceptAfterDays) { + analysis.setState(State.NOT_AFFECTED); + detail += " (policy threshold: " + acceptAfterDays + " days). Operational risk acceptance based on " + + "runtime observation, not a structural non-reachability guarantee."; + } else { + analysis.setState(State.IN_TRIAGE); + detail += " (below the " + acceptAfterDays + "-day acceptance threshold)."; + } + } else { + // EXPOSED / EXPLOITED / any unrecognized status - never suppress. + return null; + } + + analysis.setDetail(detail); + v.setAnalysis(analysis); + + List properties = new ArrayList<>(); + properties.add(property("contrast:appId", app.id)); + properties.add(property("contrast:appName", app.name)); + properties.add(property("contrast:classesUsed", String.valueOf(classesUsed))); + properties.add(property("contrast:classCount", String.valueOf(classCount))); + properties.add(property("contrast:daysObserved", String.valueOf(daysObserved))); + properties.add(property("contrast:acceptAfterDays", String.valueOf(acceptAfterDays))); + properties.add(property("contrast:envFilter", envFilter != null ? envFilter : "ALL")); + if (issue != null) { + properties.add(property("contrast:devStatus", issue.dev)); + properties.add(property("contrast:qaStatus", issue.qa)); + properties.add(property("contrast:prodStatus", issue.prod)); + } + v.setProperties(properties); + + return v; + } + + /** + * With no --env filter, a claim considers all three of the app's own environments (dev/qa/prod). + * With --env, it's scoped to just that one - e.g. --env PRODUCTION means "protected in production", + * not "protected somewhere, possibly only in dev". + */ + private List statusesToConsider(CveIssue issue) { + if (envFilter == null) { + return java.util.Arrays.asList(issue.dev, issue.qa, issue.prod); + } + switch (envFilter) { + case "DEVELOPMENT": return java.util.Arrays.asList(issue.dev); + case "QA": return java.util.Arrays.asList(issue.qa); + case "PRODUCTION": return java.util.Arrays.asList(issue.prod); + default: return java.util.Arrays.asList(issue.dev, issue.qa, issue.prod); + } + } + + private String envScopeLabel() { + return envFilter != null ? envFilter.toLowerCase() : "across its own dev/qa/prod environments"; + } + + private boolean isProtected(CveIssue issue) { + for (String status : statusesToConsider(issue)) { + if (isProtectedStatus(status)) return true; + } + return false; + } + + private boolean isProtectedStatus(String status) { + return status != null && PROTECTED_STATUSES.contains(status); + } + + private boolean isNotSeen(CveIssue issue) { + for (String status : statusesToConsider(issue)) { + if (!isNotSeenOrNull(status)) return false; + } + return true; + } + + private boolean isNotSeenOrNull(String status) { + return status == null || NOT_SEEN_STATUSES.contains(status); + } + + private String artifactNameFrom(String fileName) { + if (fileName == null) { + return "unknown"; + } + // e.g. "spring-web-4.3.9.release.jar" -> "spring-web"; best-effort, not exact for all naming schemes. + String withoutExt = fileName.replaceAll("\\.jar$", ""); + return withoutExt.replaceAll("-\\d.*$", ""); + } + + private Property property(String name, String value) { + Property p = new Property(); + p.setName(name); + p.setValue(value != null ? value : ""); + return p; + } + + private String sanitizeBomRef(String input) { + return input.toLowerCase() + .replaceAll("[^a-z0-9-]", "-") + .replaceAll("-+", "-") + .replaceAll("^-|-$", ""); + } + + private String getStringOrNull(JsonObject obj, String field) { + return obj.has(field) && !obj.get(field).isJsonNull() ? obj.get(field).getAsString() : null; + } + + public void writeVEX(Bom bom, String filename) throws Exception { + System.out.println("\nWriting VEX to " + filename); + BomJsonGenerator generator = BomGeneratorFactory.createJson(Version.VERSION_16, bom); + String json = generator.toJsonString(); + try (FileWriter writer = new FileWriter(filename)) { + writer.write(json); + } + System.out.println(" Done!"); + } +} From d14f881499f6783f1e7539abd8cef353ca932ff5 Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 17:29:38 -0400 Subject: [PATCH 02/16] Enrich VEX with description, recommendation, response, EPSS/CISA KEV signals VEXGenerator now populates several CycloneDX VEX fields that Contrast's API already returns but the generator wasn't capturing: - vulnerability.description (from the CVE record) - affects[].versions[] (deployed version as affected, Contrast's minUpgrade guidance - or latest_version as a fallback - as unaffected) - recommendation (built from Contrast's own minUpgrade/maxUpgrade remediation guidance where available) - analysis.response[] (update when a fix version is known, workaround_available for protected_at_runtime claims) - contrast:epssScore/epssPercentile and contrast:cisaKev properties (EPSS exploit-prediction score and CISA Known Exploited Vulnerabilities catalog membership) All of this is deterministic and sourced directly from Contrast's own CVE/library data - no AI involved in the claim itself, since a VEX statement is an attestation that needs to stay auditable. VEXAdvisor now actually receives the EPSS/CISA KEV signals its prompt already claimed to weigh (they were referenced in ANALYSIS_PROMPT but never parsed from the VEX or passed to the model), so its soundness judgment is grounded in real exploitability data instead of CVSS alone. Verified: builds clean, output round-trips through the CycloneDX 1.6 JSON schema validator, and a live run against SAML-PetClinic-Demo confirms real EPSS/CISA KEV values (including known KEV entries like CVE-2022-22965) and the advisor citing them in its rationale. --- README.md | 11 +- .../runtimeanalyst/VEXAdvisor.java | 26 +++++ .../runtimeanalyst/VEXGenerator.java | 101 +++++++++++++++++- 3 files changed, 133 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index c3c9626..8fe9410 100644 --- a/README.md +++ b/README.md @@ -196,10 +196,17 @@ Deliberately does **not** generate threats, controls, or risks (TM-BOM) - the dr A standard CycloneDX 1.6 document with a top-level `vulnerabilities[]` array, one entry per (application, library, CVE) with: - `id` - the CVE identifier, `source` - NVD reference +- `description` - the CVE description, as reported by Contrast - `ratings[]` - CVSS v3.1 score/severity/vector as reported by Contrast +- `advisories[]` - any reference URLs Contrast has on file for the CVE (omitted when there are none) - `affects[].ref` - a best-effort `pkg:maven/...` purl for the affected library +- `affects[].versions[]` - the deployed version (`affected`) and, when Contrast has upgrade guidance for the library, the recommended fixed version (`unaffected`) +- `recommendation` - the remediation action: Contrast's own minimal-upgrade guidance for the library when available, falling back to "no newer release identified" when it isn't - `analysis.state`/`analysis.justification`/`analysis.detail` - the VEX claim itself and why it was made (see the policy in the [`vex` examples](#vex) above) -- `properties[]` - the underlying evidence (`contrast:classesUsed`/`classCount`, `contrast:daysObserved`, `contrast:acceptAfterDays`, `contrast:devStatus`/`qaStatus`/`prodStatus`) +- `analysis.response[]` - `update` when a fix version is known, `workaround_available` for `protected_at_runtime` claims (the active Shield/Protect control **is** the workaround), omitted otherwise +- `properties[]` - the underlying evidence (`contrast:classesUsed`/`classCount`, `contrast:daysObserved`, `contrast:acceptAfterDays`, `contrast:devStatus`/`qaStatus`/`prodStatus`, `contrast:latestVersion`) plus exploitability signals (`contrast:epssScore`/`epssPercentile`, `contrast:cisaKev` - CISA Known Exploited Vulnerabilities catalog membership) + +All of the above is deterministic, pulled directly from Contrast's own CVE/library data - nothing here is AI-generated, since a VEX claim is an attestation and needs to stay auditable back to its source evidence. The EPSS/CISA KEV signals are new inputs to the **VEX Advisor**'s AI judgment (below), not to the claim itself. ``` Contrast VEX @@ -214,7 +221,7 @@ Note: `PROTECTED_AT_RUNTIME` (CVE Shield/Protect actively mitigating) is impleme - **Quantum Advisor** - findings grouped by risk level (CRITICAL/HIGH/MEDIUM/LOW/NOT_QUANTUM_ISSUE), with an "Application Context" section describing each app from its architecture graph data - **AI Advisor** - organized as an inventory of AI-enabled applications (one section per app, not per finding): an AI-generated description of what the app does, then each AI usage instance with model/provider/endpoint and a description of what that specific call is doing, inferred from the key methods around it in the stack trace -- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Organized one section per application, with a per-CVE table plus rationale for anything flagged. +- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. Organized one section per application, with a per-CVE table plus rationale for anything flagged. Both the Quantum and AI Advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component. The VEX Advisor writes `contrast:vexAdvisorAssessment` (`sound`/`needs_review`) and `contrast:vexAdvisorRationale` back onto each vulnerability's `properties[]`. All of this happens automatically as part of every `--analyze` run, no separate step needed. diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index b31e9db..fb1336f 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -80,6 +80,10 @@ static class VexStatement { String state; String justification; String detail; + String recommendation; + Double epssScore; + Double epssPercentile; + Boolean cisaKev; long classesUsed; long classCount; long daysObserved; @@ -228,10 +232,15 @@ private List parseVex(String path) throws IOException { s.justification = getString(analysis, "justification", null); s.detail = getString(analysis, "detail", null); } + s.recommendation = getString(v, "recommendation", null); s.classesUsed = parseLong(props.get("contrast:classesUsed")); s.classCount = parseLong(props.get("contrast:classCount")); s.daysObserved = parseLong(props.get("contrast:daysObserved")); s.acceptAfterDays = parseLong(props.get("contrast:acceptAfterDays")); + s.epssScore = parseDouble(props.get("contrast:epssScore")); + s.epssPercentile = parseDouble(props.get("contrast:epssPercentile")); + String cisaProp = props.get("contrast:cisaKev"); + s.cisaKev = cisaProp != null ? Boolean.parseBoolean(cisaProp) : null; byApp.computeIfAbsent(appName, k -> { AppEntry e = new AppEntry(); @@ -252,6 +261,15 @@ private long parseLong(String s) { } } + private Double parseDouble(String s) { + if (s == null || s.isEmpty()) return null; + try { + return Double.parseDouble(s); + } catch (NumberFormatException e) { + return null; + } + } + private Map properties(JsonObject component) { Map props = new LinkedHashMap<>(); if (component.has("properties")) { @@ -279,9 +297,17 @@ private String formatAppForAi(AppEntry entry) { sb.append("Library: ").append(s.purl != null ? s.purl : "unknown").append("\n"); sb.append("Severity: ").append(s.severity != null ? s.severity : "unknown") .append(s.score != null ? " (score " + s.score + ")" : "").append("\n"); + if (s.epssScore != null) { + sb.append("EPSS: ").append(s.epssScore) + .append(s.epssPercentile != null ? " (percentile " + s.epssPercentile + ")" : "").append("\n"); + } + if (s.cisaKev != null) { + sb.append("CISA Known Exploited Vulnerabilities (KEV) catalog: ").append(s.cisaKev ? "YES" : "no").append("\n"); + } sb.append("Claimed state: ").append(s.state).append("\n"); if (s.justification != null) sb.append("Justification: ").append(s.justification).append("\n"); sb.append("Detail: ").append(s.detail != null ? s.detail : "(none)").append("\n"); + if (s.recommendation != null) sb.append("Recommendation on record: ").append(s.recommendation).append("\n"); sb.append("Classes used: ").append(s.classesUsed).append(" of ").append(s.classCount).append("\n"); sb.append("Days observed: ").append(s.daysObserved).append(" (acceptance threshold: ").append(s.acceptAfterDays).append(")\n"); } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java index 0d97d90..0556983 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java @@ -27,14 +27,17 @@ import org.cyclonedx.model.Metadata; import org.cyclonedx.model.Property; import org.cyclonedx.model.vulnerability.Vulnerability; +import org.cyclonedx.model.vulnerability.Vulnerability.Advisory; import org.cyclonedx.model.vulnerability.Vulnerability.Affect; import org.cyclonedx.model.vulnerability.Vulnerability.Analysis; import org.cyclonedx.model.vulnerability.Vulnerability.Analysis.Justification; +import org.cyclonedx.model.vulnerability.Vulnerability.Analysis.Response; import org.cyclonedx.model.vulnerability.Vulnerability.Analysis.State; import org.cyclonedx.model.vulnerability.Vulnerability.Rating; import org.cyclonedx.model.vulnerability.Vulnerability.Rating.Method; import org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity; import org.cyclonedx.model.vulnerability.Vulnerability.Source; +import org.cyclonedx.model.vulnerability.Vulnerability.Version.Status; import com.google.gson.Gson; import com.google.gson.JsonArray; @@ -406,6 +409,9 @@ public Bom generateVEX(List apps) throws IOException { String hash = getStringOrNull(lib, "hash"); long classesUsed = lib.has("classes_used") ? lib.get("classes_used").getAsLong() : 0L; long classCount = lib.has("class_count") ? lib.get("class_count").getAsLong() : 0L; + JsonObject remediationGuidance = lib.has("remediationGuidance") && lib.get("remediationGuidance").isJsonObject() + ? lib.getAsJsonObject("remediationGuidance") : null; + String latestVersion = getStringOrNull(lib, "latest_version"); if (!lib.has("vulns")) { continue; @@ -420,7 +426,8 @@ public Bom generateVEX(List apps) throws IOException { Vulnerability v = buildVulnerability( app, group, fileName, fileVersion, hash, classesUsed, classCount, - cveId, vuln, cveIssues.get(cveId + "|" + fileVersion), daysObserved); + cveId, vuln, cveIssues.get(cveId + "|" + fileVersion), daysObserved, + remediationGuidance, latestVersion); if (v != null) { vulnerabilities.add(v); @@ -448,12 +455,17 @@ public Bom generateVEX(List apps) throws IOException { /** Returns null when the CVE shouldn't get a VEX statement at all (exposed/exploited/unrecognized status). */ private Vulnerability buildVulnerability(AppInfo app, String group, String fileName, String fileVersion, String hash, long classesUsed, long classCount, String cveId, JsonObject vuln, - CveIssue issue, long daysObserved) { + CveIssue issue, long daysObserved, JsonObject remediationGuidance, String latestVersion) { Vulnerability v = new Vulnerability(); v.setBomRef(sanitizeBomRef(app.id + "-" + cveId + "-" + hash)); v.setId(cveId); + String description = getStringOrNull(vuln, "description"); + if (description != null) { + v.setDescription(description); + } + Source source = new Source(); source.setName("NVD"); source.setUrl("https://nvd.nist.gov/vuln/detail/" + cveId); @@ -477,13 +489,68 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN ratings.add(rating); v.setRatings(ratings); + if (vuln.has("references") && vuln.getAsJsonArray("references").size() > 0) { + List advisories = new ArrayList<>(); + for (JsonElement refEl : vuln.getAsJsonArray("references")) { + String refUrl = refEl.isJsonPrimitive() ? refEl.getAsString() : getStringOrNull(refEl.getAsJsonObject(), "url"); + if (refUrl == null || refUrl.isEmpty()) { + continue; + } + Advisory advisory = new Advisory(); + advisory.setUrl(refUrl); + advisories.add(advisory); + } + if (!advisories.isEmpty()) { + v.setAdvisories(advisories); + } + } + String purl = "pkg:maven/" + (group != null ? group : "unknown") + "/" + artifactNameFrom(fileName) + "@" + fileVersion; Affect affect = new Affect(); affect.setRef(purl); + + // Contrast's own remediation guidance (minUpgrade = smallest version that clears this library's + // vulnerabilities) is more actionable than the library's raw latest_version, which may be newer + // than necessary or not actually address this CVE - prefer it when available. + String minUpgradeVersion = remediationGuidance != null + ? getStringOrNull(nestedObject(remediationGuidance, "minUpgrade"), "version") : null; + String maxUpgradeVersion = remediationGuidance != null + ? getStringOrNull(nestedObject(remediationGuidance, "maxUpgrade"), "version") : null; + String recommendedVersion = minUpgradeVersion != null ? minUpgradeVersion : latestVersion; + + List versions = new ArrayList<>(); + org.cyclonedx.model.vulnerability.Vulnerability.Version affectedVersion = + new org.cyclonedx.model.vulnerability.Vulnerability.Version(); + affectedVersion.setVersion(fileVersion); + affectedVersion.setStatus(Status.AFFECTED); + versions.add(affectedVersion); + boolean fixAvailable = recommendedVersion != null && !recommendedVersion.equals(fileVersion); + if (fixAvailable) { + org.cyclonedx.model.vulnerability.Vulnerability.Version fixedVersion = + new org.cyclonedx.model.vulnerability.Vulnerability.Version(); + fixedVersion.setVersion(recommendedVersion); + fixedVersion.setStatus(Status.UNAFFECTED); + versions.add(fixedVersion); + } + affect.setVersions(versions); + List affects = new ArrayList<>(); affects.add(affect); v.setAffects(affects); + String artifactName = artifactNameFrom(fileName); + if (fixAvailable) { + StringBuilder rec = new StringBuilder("Upgrade " + artifactName + " from " + fileVersion + " to " + + recommendedVersion + " to remediate " + cveId + "."); + if (maxUpgradeVersion != null && !maxUpgradeVersion.equals(recommendedVersion)) { + rec.append(" Latest available release is ").append(maxUpgradeVersion).append("."); + } + v.setRecommendation(rec.toString()); + } else { + v.setRecommendation("No newer release of " + artifactName + " is currently identified; monitor for a " + + "fix and re-run VEX generation periodically."); + } + Analysis analysis = new Analysis(); String detail; @@ -529,6 +596,18 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN } analysis.setDetail(detail); + + List responses = new ArrayList<>(); + if (analysis.getJustification() == Justification.PROTECTED_AT_RUNTIME) { + // The active Shield/Protect control is itself the mitigation in place. + responses.add(Response.WORKAROUND_AVAILABLE); + } else if (analysis.getJustification() != Justification.CODE_NOT_REACHABLE && fixAvailable) { + responses.add(Response.UPDATE); + } + if (!responses.isEmpty()) { + analysis.setResponses(responses); + } + v.setAnalysis(analysis); List properties = new ArrayList<>(); @@ -539,6 +618,18 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN properties.add(property("contrast:daysObserved", String.valueOf(daysObserved))); properties.add(property("contrast:acceptAfterDays", String.valueOf(acceptAfterDays))); properties.add(property("contrast:envFilter", envFilter != null ? envFilter : "ALL")); + if (vuln.has("epss_score") && !vuln.get("epss_score").isJsonNull()) { + properties.add(property("contrast:epssScore", String.valueOf(vuln.get("epss_score").getAsDouble()))); + } + if (vuln.has("epss_percentile") && !vuln.get("epss_percentile").isJsonNull()) { + properties.add(property("contrast:epssPercentile", String.valueOf(vuln.get("epss_percentile").getAsDouble()))); + } + if (vuln.has("cisa") && !vuln.get("cisa").isJsonNull()) { + properties.add(property("contrast:cisaKev", String.valueOf(vuln.get("cisa").getAsBoolean()))); + } + if (latestVersion != null) { + properties.add(property("contrast:latestVersion", latestVersion)); + } if (issue != null) { properties.add(property("contrast:devStatus", issue.dev)); properties.add(property("contrast:qaStatus", issue.qa)); @@ -601,6 +692,10 @@ private String artifactNameFrom(String fileName) { return withoutExt.replaceAll("-\\d.*$", ""); } + private JsonObject nestedObject(JsonObject obj, String field) { + return obj.has(field) && obj.get(field).isJsonObject() ? obj.getAsJsonObject(field) : null; + } + private Property property(String name, String value) { Property p = new Property(); p.setName(name); @@ -616,7 +711,7 @@ private String sanitizeBomRef(String input) { } private String getStringOrNull(JsonObject obj, String field) { - return obj.has(field) && !obj.get(field).isJsonNull() ? obj.get(field).getAsString() : null; + return obj != null && obj.has(field) && !obj.get(field).isJsonNull() ? obj.get(field).getAsString() : null; } public void writeVEX(Bom bom, String filename) throws Exception { From 9e284d3878842cc2fac0cd9612cd89f78555092d Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 17:40:51 -0400 Subject: [PATCH 03/16] Add samples/ with real output from every generator + advisor report Six files captured from a single live run against the org: - sample-cbom.json / sample-cbom-advisor.md - sample-aibom.json / sample-aibom-advisor.md - sample-blueprint.json (no advisor - blueprint doesn't have one) - sample-vex.json / sample-vex-advisor.md (scoped to SAML-PetClinic-Demo; a full-org VEX run is one CVE-issues API call per app and produces a much larger file for no added illustrative value) sample-vex.json also exercises the description/recommendation/response/ EPSS/CISA-KEV enrichment from the prior commit - includes real KEV hits (e.g. CVE-2022-22965). --- README.md | 13 + samples/sample-aibom-advisor.md | 114 + samples/sample-aibom.json | 172 + samples/sample-blueprint.json | 223 + samples/sample-cbom-advisor.md | 237 + samples/sample-cbom.json | 409 + samples/sample-vex-advisor.md | 533 + samples/sample-vex.json | 25739 ++++++++++++++++++++++++++++++ 8 files changed, 27440 insertions(+) create mode 100644 samples/sample-aibom-advisor.md create mode 100644 samples/sample-aibom.json create mode 100644 samples/sample-blueprint.json create mode 100644 samples/sample-cbom-advisor.md create mode 100644 samples/sample-cbom.json create mode 100644 samples/sample-vex-advisor.md create mode 100644 samples/sample-vex.json diff --git a/README.md b/README.md index 8fe9410..d1c75a7 100644 --- a/README.md +++ b/README.md @@ -240,6 +240,19 @@ Two sample AI-BOM files are included to try it with: - `sample-aibom.json` - real output from `AIBOMGenerator` against a live org (one model, both apps local/self-hosted) - `test-aibom.json` - a hand-crafted fixture covering cases the sample doesn't: multiple providers (OpenAI/Anthropic/Ollama), both cloud and local host categories, and an app with multiple call sites for the same model +## Sample Reports + +`samples/` has one real, current output from each generator and its matching advisor report, all captured against a live org in a single run - useful as a reference for what each format actually looks like without running the tool yourself: + +| CycloneDX document | Advisor report | +|---|---| +| `sample-cbom.json` | `sample-cbom-advisor.md` | +| `sample-aibom.json` | `sample-aibom-advisor.md` | +| `sample-blueprint.json` | *(no advisor - see the Blueprint section above)* | +| `sample-vex.json` | `sample-vex-advisor.md` | + +`sample-vex.json` is scoped to one application (`SAML-PetClinic-Demo`, 235 statements) rather than the whole org - a full-org VEX run makes one CVE-issues API call per application and produces a much larger file, which isn't necessary to illustrate the format. + ## Configuration Reference | Property | Description | diff --git a/samples/sample-aibom-advisor.md b/samples/sample-aibom-advisor.md new file mode 100644 index 0000000..58b0989 --- /dev/null +++ b/samples/sample-aibom-advisor.md @@ -0,0 +1,114 @@ + + +# Contrast AI Advisor +## Inventory of AI-Enabled Applications + +--- + +**Client:** Contrast AI Usage Inventory +**Report Date:** September 2, 2026 +**Assessment Type:** Runtime AI/LLM Usage Inventory & Governance Risk Assessment + +--- + +## Executive Summary + +This report inventories every AI/LLM model and provider observed actually running in production across your applications - the model, provider, destination endpoint, and real call stack behind each usage, captured by Contrast Security's runtime instrumentation. + +**2** application(s) use AI, calling **1** distinct model(s) across **1** provider(s), for **2** total usage instance(s). + +> No applications were flagged CRITICAL or HIGH risk for their AI usage. + +### Applications + +| Application | Risk Level | Models Used | +|-------------|------------|--------------| +| Robert-cargocats-aiservice | LOW | `smollm2:135m-tuned` | +| Robert-cargocats-reportservice | LOW | `smollm2:135m-tuned` | + +### Models & Providers + +| Provider | Model | Host Category | Applications | Invocations | +|----------|-------|----------------|---------------|-------------| +| openai | `smollm2:135m-tuned` | local | 2 | 2 | + +- **1** model(s) self-hosted/local (no external data egress) + +| Risk Level | Applications | +|------------|--------------| +| LOW | 2 | + +--- + +## Application Inventory + +### Robert-cargocats-aiservice + +**Risk Level:** LOW + +**Language:** JAVA | **Posture Score:** 7.4 (HIGH) | **Open Issues:** 7 | **Connects To:** Robert-cargocats-frontgateservice + +Robert-cargocats-aiservice is a Java Spring Boot backend that appears to expose AI/chat functionality to Robert-cargocats-frontgateservice, acting as an internal microservice that wraps LLM calls behind a REST API. Its name and connection graph suggest it's a dedicated AI service tier within a larger 'cargocats' application, sitting behind a gateway rather than facing the internet directly. + +**Risk Rationale:** The model is a small, self-hosted model (smollm2:135m-tuned) served via a local Ollama instance (http://ollama:11434/v1), not an external cloud provider. Since the endpoint stays inside the environment, there's no data egress to a third party, which substantially lowers governance risk even though the endpoint is called through an OpenAI-compatible client. + +**Recommendation:** Confirm the ollama host is on an internal-only network with no external exposure, and add basic usage monitoring/logging on the /openai endpoint so that if this ever gets pointed at an external provider it's caught by governance review. + +#### AI Usage + +| Attribute | Value | +|-----------|-------| +| **Model** | `smollm2:135m-tuned` | +| **Provider** | openai | +| **Endpoint** | `http://ollama:11434/v1` | +| **Host Category** | local | +| **Route** | unknown | +| **Frequency (model-wide)** | Very Low (2 invocations across all apps using this model) | +| **Reachability (this app)** | 1 code path(s) in this application | + +**What it's doing:** AiController.openai receives the request and delegates to AiService.chat, which calls the OpenAI-compatible ChatCompletionService.create client against a local Ollama server. This produces a chat completion response for the front gateway service, likely generating a reply for an end-user or upstream request routed through the gateway. + +--- + +### Robert-cargocats-reportservice + +**Risk Level:** LOW + +**Language:** JAVA | **Posture Score:** 6.7 (MEDIUM) | **Open Issues:** 2 | **Connects To:** Robert-cargocats-frontgateservice + +Robert-cargocats-reportservice is a Java-based Tomcat servlet application that appears to generate logistics reports for the CargoCats system, connected to a front gateway service that likely routes client requests to it. Its servlet-based structure (InsightServlet, LogisticsInsightService) suggests it produces analytical or insight-driven reporting on logistics data rather than handling raw transactional traffic itself. + +**Risk Rationale:** The model is served via a local Ollama instance (http://ollama:11434/v1) using the OpenAI-compatible client, meaning no data leaves the internal network to a third-party provider. This is self-hosted inference, so there's no external data egress concern, though it's worth confirming the model and endpoint are intentionally deployed rather than a developer default left in place. + +**Recommendation:** Confirm that the Ollama deployment is an intentionally provisioned internal service (not a leftover dev/test container) and document it in the AI governance inventory. Add monitoring for prompt/response content if logistics data passed to LogisticsInsightService includes sensitive shipment, customer, or partner details. + +#### AI Usage + +| Attribute | Value | +|-----------|-------| +| **Model** | `smollm2:135m-tuned` | +| **Provider** | openai | +| **Endpoint** | `http://ollama:11434/v1` | +| **Host Category** | local | +| **Route** | unknown | +| **Frequency (model-wide)** | Very Low (2 invocations across all apps using this model) | +| **Reachability (this app)** | 1 code path(s) in this application | + +**What it's doing:** InsightServlet.doPost handles an incoming POST request and calls LogisticsInsightService.getInsight, which invokes the OpenAI-compatible ChatCompletionService.create client against a local Ollama endpoint. This generates an AI-derived insight or summary for logistics report data as part of the report service's POST endpoint. + +--- + +## Appendix: Methodology + +AI/LLM usage data collected via Contrast Security runtime instrumentation. Application descriptions and connection data are derived from the Contrast architecture graph (application, server, and library relationships); AI usage descriptions are inferred from the real stack trace captured at each call site. + +- **CRITICAL**: Likely sensitive/regulated data sent to an unvetted third-party model +- **HIGH**: Production cloud AI usage without an apparent governance process +- **MEDIUM**: Approved-looking usage lacking monitoring, or non-production usage that could reach production +- **LOW**: Local/self-hosted usage or clearly low-sensitivity usage +- **NOT_AI_RISK_ISSUE**: Benign, well-governed usage with no identifiable risk signal + +--- + +*Report generated by Contrast AI Advisor* +*Powered by Contrast Security Runtime Observability* diff --git a/samples/sample-aibom.json b/samples/sample-aibom.json new file mode 100644 index 0000000..f3830ee --- /dev/null +++ b/samples/sample-aibom.json @@ -0,0 +1,172 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:05f38b34-af16-4e16-b8d8-9d826c828595", + "version": 1, + "metadata": { + "timestamp": "2026-09-02T21:36:18Z", + "component": { + "type": "application", + "bom-ref": "contrast-ai-inventory", + "name": "Contrast AI Usage Inventory", + "version": "1.0" + } + }, + "components": [ + { + "type": "machine-learning-model", + "bom-ref": "ai-openai-smollm2-135m-tuned", + "publisher": "openai", + "name": "smollm2:135m-tuned", + "properties": [ + { + "name": "contrast:usageCount", + "value": "2" + }, + { + "name": "contrast:uniqueLocations", + "value": "2" + }, + { + "name": "contrast:provider", + "value": "openai" + }, + { + "name": "contrast:endpoint", + "value": "http://ollama:11434/v1" + }, + { + "name": "contrast:hostCategory", + "value": "local" + } + ], + "evidence": { + "occurrences": [ + { + "location": "com.openai.services.blocking.chat.ChatCompletionServiceImpl$WithRawResponseImpl.create(ChatCompletionServiceImpl.kt)", + "additionalContext": "App: Robert-cargocats-aiservice Stack Trace: com.openai.services.blocking.chat.ChatCompletionServiceImpl$WithRawResponseImpl.create(ChatCompletionServiceImpl.kt) com.openai.services.blocking.chat.ChatCompletionServiceImpl.create(ChatCompletionServiceImpl.kt:63) com.openai.services.blocking.chat.ChatCompletionService.create(ChatCompletionService.kt:64) com.contrast.aiservice.AiService.chat(AiService.java:54) com.contrast.aiservice.AiController.openai(AiController.java:30) java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) java.base/java.lang.reflect.Method.invoke(Unknown Source) org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258) org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191) org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118) org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986) org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891) org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089) org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979) org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014) org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:903) jakarta.servlet.http.HttpServlet.service(HttpServlet.java:564) org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885) jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:195) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167) org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:483) org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:116) org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:732) org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344) org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:398) org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:903) org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1740) org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1189) org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:658) org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63) java.base/java.lang.Thread.run(Unknown Source)" + }, + { + "location": "com.openai.services.blocking.chat.ChatCompletionServiceImpl$WithRawResponseImpl.create(ChatCompletionServiceImpl.kt)", + "additionalContext": "App: Robert-cargocats-reportservice Stack Trace: com.openai.services.blocking.chat.ChatCompletionServiceImpl$WithRawResponseImpl.create(ChatCompletionServiceImpl.kt) com.openai.services.blocking.chat.ChatCompletionServiceImpl.create(ChatCompletionServiceImpl.kt:63) com.openai.services.blocking.chat.ChatCompletionService.create(ChatCompletionService.kt:64) com.contrast.reportservice.LogisticsInsightService.getInsight(LogisticsInsightService.java:62) com.contrast.reportservice.InsightServlet.doPost(InsightServlet.java:36) javax.servlet.http.HttpServlet.service(HttpServlet.java:555) javax.servlet.http.HttpServlet.service(HttpServlet.java:623) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:201) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:146) org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:57) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:170) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:146) org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166) org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:88) org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:534) org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:129) org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:86) org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:764) org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:71) org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:350) org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:407) org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:71) org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:1344) org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:2089) org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:74) org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:976) org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:494) org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:80) java.base/java.lang.Thread.run(Thread.java:840)" + } + ] + } + }, + { + "type": "application", + "bom-ref": "app-robert-cargocats-aiservice", + "name": "Robert-cargocats-aiservice", + "externalReferences": [ + { + "type": "runtime-analysis-report", + "url": "https://eval.contrastsecurity.com/Contrast/cs/index.html#/6a3073a5-5e68-40e5-9d7d-165340fff15a/explorer?detailsId\u003d-606870275\u0026applicationId\u003d5e888a9b-a094-490a-ab35-01eec6afcb50", + "comment": "Contrast Application Explorer" + } + ], + "properties": [ + { + "name": "contrast:language", + "value": "JAVA" + }, + { + "name": "contrast:postureScore", + "value": "7.4" + }, + { + "name": "contrast:postureSeverity", + "value": "HIGH" + }, + { + "name": "contrast:criticality", + "value": "3" + }, + { + "name": "contrast:openIssuesTotal", + "value": "7" + }, + { + "name": "contrast:serverCount", + "value": "1" + }, + { + "name": "contrast:libraryCount", + "value": "56" + }, + { + "name": "contrast:connectedApplications", + "value": "Robert-cargocats-frontgateservice" + } + ], + "description": "Robert-cargocats-aiservice is a Java Spring Boot backend that appears to expose AI/chat functionality to Robert-cargocats-frontgateservice, acting as an internal microservice that wraps LLM calls behind a REST API. Its name and connection graph suggest it\u0027s a dedicated AI service tier within a larger \u0027cargocats\u0027 application, sitting behind a gateway rather than facing the internet directly." + }, + { + "type": "application", + "bom-ref": "app-robert-cargocats-reportservice", + "name": "Robert-cargocats-reportservice", + "externalReferences": [ + { + "type": "runtime-analysis-report", + "url": "https://eval.contrastsecurity.com/Contrast/cs/index.html#/6a3073a5-5e68-40e5-9d7d-165340fff15a/explorer?detailsId\u003d-929795855\u0026applicationId\u003dd4b29958-8dca-4945-a9f7-bbae45e0f757", + "comment": "Contrast Application Explorer" + } + ], + "properties": [ + { + "name": "contrast:language", + "value": "JAVA" + }, + { + "name": "contrast:postureScore", + "value": "6.7" + }, + { + "name": "contrast:postureSeverity", + "value": "MEDIUM" + }, + { + "name": "contrast:criticality", + "value": "3" + }, + { + "name": "contrast:openIssuesTotal", + "value": "2" + }, + { + "name": "contrast:serverCount", + "value": "1" + }, + { + "name": "contrast:libraryCount", + "value": "31" + }, + { + "name": "contrast:connectedApplications", + "value": "Robert-cargocats-frontgateservice" + } + ], + "description": "Robert-cargocats-reportservice is a Java-based Tomcat servlet application that appears to generate logistics reports for the CargoCats system, connected to a front gateway service that likely routes client requests to it. Its servlet-based structure (InsightServlet, LogisticsInsightService) suggests it produces analytical or insight-driven reporting on logistics data rather than handling raw transactional traffic itself." + } + ], + "dependencies": [ + { + "ref": "app-robert-cargocats-aiservice", + "dependsOn": [ + "ai-openai-smollm2-135m-tuned" + ] + }, + { + "ref": "app-robert-cargocats-reportservice", + "dependsOn": [ + "ai-openai-smollm2-135m-tuned" + ] + }, + { + "ref": "contrast-ai-inventory", + "dependsOn": [ + "app-robert-cargocats-aiservice", + "app-robert-cargocats-reportservice" + ] + } + ] +} \ No newline at end of file diff --git a/samples/sample-blueprint.json b/samples/sample-blueprint.json new file mode 100644 index 0000000..349572a --- /dev/null +++ b/samples/sample-blueprint.json @@ -0,0 +1,223 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:4777c422-3d4b-435c-bd82-87be40d6604f", + "version": 1, + "metadata": { + "timestamp": "2026-09-02T21:36:50.226Z" + }, + "blueprints": [ + { + "bom-ref": "blueprint-1", + "name": "Contrast Architecture Blueprint", + "description": "Generated from Contrast runtime observability data: application architecture/connections (contrast-graph) and crypto/AI usage observations, mapped onto the CycloneDX behavior taxonomy. Does not include threats, controls, or risks - see TM-BOM.", + "modelTypes": [ + "architecture", + "behavioral" + ], + "assets": [ + { + "bom-ref": "asset-app-robert-cargocats-aiservice", + "name": "Robert-cargocats-aiservice", + "type": "system", + "classification": { + "criticality": "moderate" + }, + "properties": [ + { + "name": "contrast:language", + "value": "JAVA" + }, + { + "name": "contrast:postureScore", + "value": "7.4" + }, + { + "name": "contrast:postureSeverity", + "value": "HIGH" + }, + { + "name": "contrast:openIssuesTotal", + "value": "7" + }, + { + "name": "contrast:serverCount", + "value": "1" + }, + { + "name": "contrast:libraryCount", + "value": "56" + } + ], + "zone": "zone-env-qa" + }, + { + "bom-ref": "asset-app-cargo-crypto-contrast-cargo-cats-dataservice", + "name": "Cargo-Crypto-contrast-cargo-cats-dataservice", + "type": "system", + "zone": "zone-env-development" + }, + { + "bom-ref": "asset-app-robert-cargocats-reportservice", + "name": "Robert-cargocats-reportservice", + "type": "system", + "classification": { + "criticality": "moderate" + }, + "properties": [ + { + "name": "contrast:language", + "value": "JAVA" + }, + { + "name": "contrast:postureScore", + "value": "6.7" + }, + { + "name": "contrast:postureSeverity", + "value": "MEDIUM" + }, + { + "name": "contrast:openIssuesTotal", + "value": "2" + }, + { + "name": "contrast:serverCount", + "value": "1" + }, + { + "name": "contrast:libraryCount", + "value": "31" + } + ], + "zone": "zone-env-qa" + }, + { + "bom-ref": "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice", + "name": "Cargo-Crypto-contrast-cargo-cats-frontgateservice", + "type": "system", + "zone": "zone-env-development" + }, + { + "bom-ref": "asset-external-robert-cargocats-frontgateservice", + "name": "Robert-cargocats-frontgateservice", + "type": "system", + "description": "Known only as an architecture-graph connection target; no application-level data available." + }, + { + "bom-ref": "asset-external-robert-cargocats-dataservice", + "name": "Robert-cargocats-dataservice", + "type": "system", + "description": "Known only as an architecture-graph connection target; no application-level data available." + } + ], + "zones": [ + { + "bom-ref": "zone-env-qa", + "name": "QA", + "type": "deployment" + }, + { + "bom-ref": "zone-env-development", + "name": "DEVELOPMENT", + "type": "deployment" + } + ], + "flows": [ + { + "bom-ref": "flow-1", + "name": "Robert-cargocats-reportservice \u003c-\u003e Robert-cargocats-frontgateservice", + "type": "data", + "source": "asset-app-robert-cargocats-reportservice", + "destination": "asset-external-robert-cargocats-frontgateservice", + "bidirectional": true + }, + { + "bom-ref": "flow-2", + "name": "Robert-cargocats-aiservice \u003c-\u003e Robert-cargocats-frontgateservice", + "type": "data", + "source": "asset-app-robert-cargocats-aiservice", + "destination": "asset-external-robert-cargocats-frontgateservice", + "bidirectional": true + } + ], + "behaviors": { + "instances": [ + { + "bom-ref": "behavior-1", + "behavior": "ai:generative:processesPrompt", + "actors": [ + "asset-app-robert-cargocats-aiservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-2", + "behavior": "security:cryptography:encryptsData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-3", + "behavior": "security:cryptography:hashesData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-dataservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-4", + "behavior": "security:cryptography:hashesData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-5", + "behavior": "ai:generative:processesPrompt", + "actors": [ + "asset-app-robert-cargocats-reportservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-6", + "behavior": "security:cryptography:encryptsData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-dataservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-7", + "behavior": "security:cryptography:hashesData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-8", + "behavior": "security:cryptography:hashesData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-9", + "behavior": "security:cryptography:hashesData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-dataservice" + ], + "trigger": "unknown" + } + ] + } + } + ] +} \ No newline at end of file diff --git a/samples/sample-cbom-advisor.md b/samples/sample-cbom-advisor.md new file mode 100644 index 0000000..6ff0b93 --- /dev/null +++ b/samples/sample-cbom-advisor.md @@ -0,0 +1,237 @@ + + +# Contrast Quantum Advisor +## Post-Quantum Cryptography Readiness Assessment + +--- + +**Client:** Contrast Crypto Inventory +**Report Date:** September 2, 2026 +**Assessment Type:** Runtime Cryptographic Analysis & Quantum Risk Assessment + +--- + +## Executive Summary + +This assessment inventories every cryptographic algorithm actually observed running in production across your applications - algorithm strength, mode, invocation frequency, and the real call context behind each finding, captured by Contrast Security's runtime instrumentation rather than declared dependencies or static code scanning. + +**2** application(s) use cryptography, calling **4** distinct algorithm(s), for **7** total findings analyzed. + +> No algorithms were flagged as needing post-quantum remediation. + +### Applications + +| Application | Algorithms Used | +|-------------|------------------| +| Cargo-Crypto-contrast-cargo-cats-dataservice | `AES/GCM/NoPadding`, `MD5`, `SHA-256` | +| Cargo-Crypto-contrast-cargo-cats-frontgateservice | `AES/GCM/NoPadding`, `MD5`, `SHA-1`, `SHA-256` | + +### Algorithms + +| Algorithm | Risk Level | Applications | Invocations | +|-----------|------------|---------------|-------------| +| `AES/GCM/NoPadding` | LOW | 2 | 124 | +| `MD5` | UNKNOWN | 2 | 5 | +| `SHA-1` | NOT_QUANTUM_ISSUE | 1 | 1 | +| `SHA-256` | UNKNOWN | 2 | 868 | + +- **0** algorithm(s) need post-quantum remediation (CRITICAL/HIGH/MEDIUM) +- **1** algorithm(s) are quantum-safe as-is (LOW) +- **1** algorithm(s) have classical (non-quantum) weaknesses to address separately + +### Application Context + +**Cargo-Crypto-contrast-cargo-cats-dataservice** + +Based on its name, this is likely a data service component for an application called "Cargo Cats," probably handling data persistence or retrieval for that system. With no observed connections or third-party libraries, it may be a newly instrumented, isolated, or lightly-used service, so this description should be treated as a low-confidence guess rather than a confirmed architectural role. + +**Cargo-Crypto-contrast-cargo-cats-frontgateservice** + +Based on its name, this is most likely the front-facing API gateway for the "Cargo Cats" application suite, handling inbound traffic and routing requests toward backend services. Since no connected applications or third-party libraries were observed, its architecture graph data is likely incomplete or it operates in isolation from the instrumented environment. + + +### Quantum Risk Overview + +> ✅ **No critical quantum vulnerabilities detected** + +### Code Source Summary + +| Source Type | Count | Remediation Approach | +|-------------|-------|---------------------| +| 🏠 Custom Code | 5 | Direct code change by dev team | +| ❓ Unknown | 2 | Requires investigation | + +--- + +## Detailed Findings + +### 🟢 Low Priority (Quantum-Safe) + +#### [LOW] Finding 1: No action needed - SHA-256 usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice + +| Attribute | Value | +|-----------|-------| +| **Algorithm** | `SHA-256` | +| **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | +| **Code Source** | 🏠 Custom Code | +| **Source Package** | `Unknown - stack trace not provided, cannot determine exact origin package` | +| **Remediation Owner** | No remediation owner needed at this time | +| **Frequency** | Low (868 invocations) | +| **Reachability** | 2 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown, no stack trace or entry point provided to determine specific data being hashed | +| **Data Lifetime** | short-term | + +**Description:** Application computes SHA-256 hashes, likely for integrity checks, checksums, or similar purposes. + +**Quantum Threat Analysis:** SHA-256 is a symmetric hash function. Grover's algorithm only provides a quadratic speedup against hash functions, reducing SHA-256's effective security from 256 bits to roughly 128 bits, which remains well above the security margin considered safe against quantum attacks. This is not vulnerable to Shor's algorithm since it isn't asymmetric. + +**Recommendation:** No remediation required. SHA-256 is quantum-resistant at current NIST security levels and does not need replacement as part of post-quantum migration planning. + +**Remediation Plan:** +None required. If this hash is being used in a context involving digital signatures or key exchange elsewhere in the same code path, those adjacent mechanisms should be evaluated separately since they may carry quantum risk even though SHA-256 itself does not. + +--- + +#### [LOW] Finding 2: No action needed for AES-GCM usage in Cargo-Crypto-contrast-cargo-cats-dataservice + +| Attribute | Value | +|-----------|-------| +| **Algorithm** | `AES/GCM/NoPadding` | +| **Application** | Cargo-Crypto-contrast-cargo-cats-dataservice | +| **Code Source** | 🏠 Custom Code | +| **Source Package** | `Unable to determine, no stack trace provided` | +| **Remediation Owner** | N/A, no fix required for quantum resistance | +| **Frequency** | Low (124 invocations) | +| **Reachability** | 2 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown, no stack trace or entry point provided to determine specific data type | +| **Data Lifetime** | unknown | + +**Description:** The application uses AES/GCM/NoPadding for authenticated symmetric encryption, likely protecting data at rest or in transit. + +**Quantum Threat Analysis:** AES-GCM is a symmetric algorithm. Grover's Algorithm only reduces its effective security by half, so AES-256-GCM remains at 128-bit security post-quantum, still considered secure. If this is AES-128-GCM, it would drop to an effective 64-bit security level, which is a concern independent of quantum computing and should be reviewed for key size. + +**Recommendation:** Confirm the key size in use. If AES-256, no action is needed for quantum resistance. If AES-128, plan to upgrade to AES-256 to maintain long-term security margins, though this is a classical strength issue, not a quantum-specific one. + +**Remediation Plan:** +No stack trace was provided in this instance, so the specific code location and key size could not be verified. Request the full stack trace and confirm the key length parameter passed to Cipher.getInstance or equivalent key generation call before closing this out. + +--- + +#### [LOW] Finding 3: No action needed: AES/GCM authenticated encryption in Cargo-Crypto-contrast-cargo-cats-frontgateservice + +| Attribute | Value | +|-----------|-------| +| **Algorithm** | `AES/GCM/NoPadding` | +| **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | +| **Code Source** | 🏠 Custom Code | +| **Source Package** | `Unknown, no stack trace provided` | +| **Remediation Owner** | No remediation owner needed for this algorithm itself | +| **Frequency** | Low (124 invocations) | +| **Reachability** | 2 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown, no stack trace provided, but AES-GCM is typically used for data-at-rest or payload encryption | +| **Data Lifetime** | long-term | + +**Description:** Application uses AES/GCM/NoPadding for authenticated symmetric encryption, likely protecting data at rest or in transit payloads. + +**Quantum Threat Analysis:** AES is a symmetric cipher, only vulnerable to Grover's algorithm, which merely halves effective key strength. AES-256/GCM remains secure against quantum attack. If the implementation uses AES-128, effective post-quantum strength drops to approximately 64 bits, which is a separate concern worth verifying. + +**Recommendation:** No replacement required for the AES/GCM algorithm itself. Confirm the actual key size in use, if this is AES-128, plan an upgrade to AES-256 to maintain adequate post-quantum security margin. Also verify the key exchange or key management mechanism that provisions this AES key, since that mechanism (if asymmetric) is the actual quantum risk, not the AES-GCM operation itself. + +**Remediation Plan:** +No stack trace or entry point was provided with this finding, so code source and key size could not be confirmed. Pull the actual observation details/stack trace from Contrast to identify the calling class and confirm key length. If key material is derived via RSA/ECDH key exchange upstream, that component should be evaluated separately for quantum risk under CRITICAL/HIGH criteria. + +--- + +### ⚪ Non-Quantum Issues + +#### [NOT_QUANTUM_ISSUE] Finding 4: Replace SHA-1 in Cargo-Crypto-contrast-cargo-cats-frontgateservice + +| Attribute | Value | +|-----------|-------| +| **Algorithm** | `SHA-1` | +| **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | +| **Code Source** | 🏠 Custom Code | +| **Source Package** | `Unknown, stack trace not provided` | +| **Remediation Owner** | Application development team (pending stack trace confirmation) | +| **Frequency** | Very Low (1 invocations) | +| **Reachability** | 1 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown, no stack trace available to determine data type | +| **Data Lifetime** | short-term | + +**Description:** Application computes a SHA-1 hash, purpose unclear due to missing stack trace and entry point data + +**Quantum Threat Analysis:** SHA-1 is not a quantum-specific concern. Grover's algorithm only reduces effective security by a square-root factor, and SHA-1's 160-bit output would still nominally hit 80-bit quantum resistance, but SHA-1 is already classically broken via collision attacks (e.g., SHAttered) and should be replaced regardless of quantum considerations. + +**Recommendation:** Replace SHA-1 with SHA-256 or better for any security-relevant use (integrity checks, digital signatures, certificate fingerprints). If SHA-1 is used only for non-security purposes (e.g., cache keys, checksums for deduplication), it may be acceptable to leave in place, but this should be confirmed by reviewing the actual call site. + +**Remediation Plan:** +No stack trace or entry point was provided for this finding, so the exact code location and purpose of the SHA-1 call could not be determined. Re-run the observation with full stack trace capture enabled to identify the source package and calling class before assigning remediation ownership. Once located, swap MessageDigest.getInstance("SHA-1") for "SHA-256" and verify no downstream systems depend on the specific 160-bit output length or format. + +--- + +#### [NOT_QUANTUM_ISSUE] Finding 5: Replace MD5 hashing in Cargo-Crypto-contrast-cargo-cats-frontgateservice + +| Attribute | Value | +|-----------|-------| +| **Algorithm** | `MD5` | +| **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | +| **Code Source** | 🏠 Custom Code | +| **Source Package** | `Unknown, no stack trace provided` | +| **Remediation Owner** | Application development team for Cargo-Crypto-contrast-cargo-cats-frontgateservice | +| **Frequency** | Very Low (5 invocations) | +| **Reachability** | 2 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown, no stack trace or entry point provided to determine what data is being hashed | +| **Data Lifetime** | unknown | + +**Description:** Application computes MD5 hashes, likely for checksums, cache keys, or similar non-cryptographic purposes. + +**Quantum Threat Analysis:** MD5 is not a quantum vulnerability. It's classically broken due to well-known collision attacks (Grover's algorithm only affects hash preimage resistance by a square root factor, which is not the issue here). This is a legacy cryptographic weakness unrelated to post-quantum migration planning. + +**Recommendation:** Treat this as a classical crypto hygiene finding rather than a quantum migration item. If MD5 is used for any security purpose (integrity checks, password handling, digital signatures), replace it with SHA-256 or SHA-3. If it's used for non-security purposes (cache keys, checksums for non-adversarial data), it may be lower priority but should still be documented as a known weak algorithm. + +**Remediation Plan:** +No stack trace or entry point was provided in this observation, so the exact code location and usage context couldn't be determined. Recommend pulling the full stack trace from the CBOM evidence to confirm whether this is a security-relevant use case before prioritizing remediation. If used for signatures or authentication, escalate to CRITICAL under classical crypto risk, separate from this quantum-specific assessment. + +--- + +## Appendix A: Algorithm Risk Matrix + +| Algorithm | Quantum Risk | Remediation Timeline | +|-----------|--------------|----------------------| +| `AES/GCM/NoPadding` | 🟢 LOW | ✅ No action needed | +| `SHA-1` | ⚪ NOT_QUANTUM_ISSUE | 🔧 Classical security fix | +| `SHA-256` | ❓ UNKNOWN | Review | +| `MD5` | ❓ UNKNOWN | Review | + +--- + +## Appendix B: Methodology + +### Quantum Threat Model + +This assessment evaluates cryptographic algorithms against two primary quantum computing threats: + +| Threat | Impact | Affected Algorithms | +|--------|--------|---------------------| +| **Shor's Algorithm** | Complete break of asymmetric crypto | RSA, ECDSA, ECDH, DH, DSA | +| **Grover's Algorithm** | Halves effective key length | AES, SHA (still safe at 256-bit) | + +### Risk Classification Criteria + +- **CRITICAL**: Asymmetric cryptography protecting long-term secrets, digital signatures, or stored data +- **HIGH**: Asymmetric cryptography for sensitive data with medium-term exposure +- **MEDIUM**: Asymmetric cryptography with forward secrecy mitigations +- **LOW**: Symmetric cryptography with sufficient key sizes (quantum-resistant) +- **NOT_QUANTUM_ISSUE**: Classical cryptographic weaknesses unrelated to quantum threats + +### Data Sources + +Cryptographic usage data collected via Contrast Security runtime instrumentation, providing: +- Actual algorithms in use (not just declared dependencies) +- Complete call stack context for usage classification +- Invocation frequency and code path reachability metrics + +--- + +*Report generated by Contrast Quantum Advisor* +*Powered by Contrast Security Runtime Observability* diff --git a/samples/sample-cbom.json b/samples/sample-cbom.json new file mode 100644 index 0000000..2211310 --- /dev/null +++ b/samples/sample-cbom.json @@ -0,0 +1,409 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:a49f9bc3-dafb-443e-a4d9-bbe6b14ccb42", + "version": 1, + "metadata": { + "timestamp": "2026-09-02T21:34:18Z", + "component": { + "type": "application", + "bom-ref": "contrast-crypto-inventory", + "name": "Contrast Crypto Inventory", + "version": "1.0" + }, + "properties": [ + { + "name": "quantum:enhancedAt", + "value": "2026-09-02T17:36:13.710929" + }, + { + "name": "quantum:enhancedBy", + "value": "Contrast Quantum Advisor" + } + ] + }, + "components": [ + { + "type": "cryptographic-asset", + "bom-ref": "crypto-sha-1", + "name": "SHA-1", + "properties": [ + { + "name": "contrast:usageCount", + "value": "1" + }, + { + "name": "contrast:uniqueLocations", + "value": "1" + }, + { + "name": "quantum:riskLevel", + "value": "NOT_QUANTUM_ISSUE" + }, + { + "name": "quantum:title", + "value": "Replace SHA-1 in Cargo-Crypto-contrast-cargo-cats-frontgateservice" + }, + { + "name": "quantum:usageSummary", + "value": "Application computes a SHA-1 hash, purpose unclear due to missing stack trace and entry point data" + }, + { + "name": "quantum:dataSensitivity", + "value": "Unknown, no stack trace available to determine data type" + }, + { + "name": "quantum:dataLifetime", + "value": "short-term" + }, + { + "name": "quantum:codeSource", + "value": "custom_code" + }, + { + "name": "quantum:sourcePackage", + "value": "Unknown, stack trace not provided" + }, + { + "name": "quantum:remediationOwner", + "value": "Application development team (pending stack trace confirmation)" + }, + { + "name": "quantum:quantumThreat", + "value": "SHA-1 is not a quantum-specific concern. Grover\u0027s algorithm only reduces effective security by a square-root factor, and SHA-1\u0027s 160-bit output would still nominally hit 80-bit quantum resistance, but SHA-1 is already classically broken via collision attacks (e.g., SHAttered) and should be replaced regardless of quantum considerations." + }, + { + "name": "quantum:recommendation", + "value": "Replace SHA-1 with SHA-256 or better for any security-relevant use (integrity checks, digital signatures, certificate fingerprints). If SHA-1 is used only for non-security purposes (e.g., cache keys, checksums for deduplication), it may be acceptable to leave in place, but this should be confirmed by reviewing the actual call site." + }, + { + "name": "quantum:migrationNotes", + "value": "No stack trace or entry point was provided for this finding, so the exact code location and purpose of the SHA-1 call could not be determined. Re-run the observation with full stack trace capture enabled to identify the source package and calling class before assigning remediation ownership. Once located, swap MessageDigest.getInstance(\"SHA-1\") for \"SHA-256\" and verify no downstream systems depend on the specific 160-bit output length or format." + }, + { + "name": "quantum:findingsAnalyzed", + "value": "1" + } + ], + "evidence": { + "occurrences": [ + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" + } + ] + }, + "cryptoProperties": { + "assetType": "algorithm", + "algorithmProperties": { + "primitive": "hash", + "parameterSetIdentifier": "160", + "cryptoFunctions": [ + "digest" + ], + "classicalSecurityLevel": 80, + "nistQuantumSecurityLevel": 1 + }, + "oid": "1.3.14.3.2.26" + } + }, + { + "type": "cryptographic-asset", + "bom-ref": "crypto-sha-256", + "name": "SHA-256", + "properties": [ + { + "name": "contrast:usageCount", + "value": "868" + }, + { + "name": "contrast:uniqueLocations", + "value": "2" + }, + { + "name": "quantum:riskLevel", + "value": "LOW" + }, + { + "name": "quantum:title", + "value": "No action needed - SHA-256 usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice" + }, + { + "name": "quantum:usageSummary", + "value": "Application computes SHA-256 hashes, likely for integrity checks, checksums, or similar purposes." + }, + { + "name": "quantum:dataSensitivity", + "value": "Unknown, no stack trace or entry point provided to determine specific data being hashed" + }, + { + "name": "quantum:dataLifetime", + "value": "short-term" + }, + { + "name": "quantum:codeSource", + "value": "custom_code" + }, + { + "name": "quantum:sourcePackage", + "value": "Unknown - stack trace not provided, cannot determine exact origin package" + }, + { + "name": "quantum:remediationOwner", + "value": "No remediation owner needed at this time" + }, + { + "name": "quantum:quantumThreat", + "value": "SHA-256 is a symmetric hash function. Grover\u0027s algorithm only provides a quadratic speedup against hash functions, reducing SHA-256\u0027s effective security from 256 bits to roughly 128 bits, which remains well above the security margin considered safe against quantum attacks. This is not vulnerable to Shor\u0027s algorithm since it isn\u0027t asymmetric." + }, + { + "name": "quantum:recommendation", + "value": "No remediation required. SHA-256 is quantum-resistant at current NIST security levels and does not need replacement as part of post-quantum migration planning." + }, + { + "name": "quantum:migrationNotes", + "value": "None required. If this hash is being used in a context involving digital signatures or key exchange elsewhere in the same code path, those adjacent mechanisms should be evaluated separately since they may carry quantum risk even though SHA-256 itself does not." + }, + { + "name": "quantum:findingsAnalyzed", + "value": "2" + } + ], + "evidence": { + "occurrences": [ + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-dataservice" + }, + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" + } + ] + }, + "cryptoProperties": { + "assetType": "algorithm", + "algorithmProperties": { + "primitive": "hash", + "parameterSetIdentifier": "256", + "cryptoFunctions": [ + "digest" + ], + "classicalSecurityLevel": 128, + "nistQuantumSecurityLevel": 3 + }, + "oid": "2.16.840.1.101.3.4.2.1" + } + }, + { + "type": "cryptographic-asset", + "bom-ref": "crypto-md5", + "name": "MD5", + "properties": [ + { + "name": "contrast:usageCount", + "value": "5" + }, + { + "name": "contrast:uniqueLocations", + "value": "2" + }, + { + "name": "quantum:riskLevel", + "value": "NOT_QUANTUM_ISSUE" + }, + { + "name": "quantum:title", + "value": "Replace MD5 hashing in Cargo-Crypto-contrast-cargo-cats-frontgateservice" + }, + { + "name": "quantum:usageSummary", + "value": "Application computes MD5 hashes, likely for checksums, cache keys, or similar non-cryptographic purposes." + }, + { + "name": "quantum:dataSensitivity", + "value": "Unknown, no stack trace or entry point provided to determine what data is being hashed" + }, + { + "name": "quantum:dataLifetime", + "value": "unknown" + }, + { + "name": "quantum:codeSource", + "value": "custom_code" + }, + { + "name": "quantum:sourcePackage", + "value": "Unknown, no stack trace provided" + }, + { + "name": "quantum:remediationOwner", + "value": "Application development team for Cargo-Crypto-contrast-cargo-cats-frontgateservice" + }, + { + "name": "quantum:quantumThreat", + "value": "MD5 is not a quantum vulnerability. It\u0027s classically broken due to well-known collision attacks (Grover\u0027s algorithm only affects hash preimage resistance by a square root factor, which is not the issue here). This is a legacy cryptographic weakness unrelated to post-quantum migration planning." + }, + { + "name": "quantum:recommendation", + "value": "Treat this as a classical crypto hygiene finding rather than a quantum migration item. If MD5 is used for any security purpose (integrity checks, password handling, digital signatures), replace it with SHA-256 or SHA-3. If it\u0027s used for non-security purposes (cache keys, checksums for non-adversarial data), it may be lower priority but should still be documented as a known weak algorithm." + }, + { + "name": "quantum:migrationNotes", + "value": "No stack trace or entry point was provided in this observation, so the exact code location and usage context couldn\u0027t be determined. Recommend pulling the full stack trace from the CBOM evidence to confirm whether this is a security-relevant use case before prioritizing remediation. If used for signatures or authentication, escalate to CRITICAL under classical crypto risk, separate from this quantum-specific assessment." + }, + { + "name": "quantum:findingsAnalyzed", + "value": "2" + } + ], + "evidence": { + "occurrences": [ + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-dataservice" + }, + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" + } + ] + }, + "cryptoProperties": { + "assetType": "algorithm", + "algorithmProperties": { + "primitive": "hash", + "parameterSetIdentifier": "128", + "cryptoFunctions": [ + "digest" + ], + "nistQuantumSecurityLevel": 0 + }, + "oid": "1.2.840.113549.2.5" + } + }, + { + "type": "cryptographic-asset", + "bom-ref": "crypto-aes-gcm-nopadding", + "name": "AES/GCM/NoPadding", + "properties": [ + { + "name": "contrast:usageCount", + "value": "124" + }, + { + "name": "contrast:uniqueLocations", + "value": "2" + }, + { + "name": "quantum:riskLevel", + "value": "LOW" + }, + { + "name": "quantum:title", + "value": "No action needed for AES-GCM usage in Cargo-Crypto-contrast-cargo-cats-dataservice" + }, + { + "name": "quantum:usageSummary", + "value": "The application uses AES/GCM/NoPadding for authenticated symmetric encryption, likely protecting data at rest or in transit." + }, + { + "name": "quantum:dataSensitivity", + "value": "Unknown, no stack trace or entry point provided to determine specific data type" + }, + { + "name": "quantum:dataLifetime", + "value": "unknown" + }, + { + "name": "quantum:codeSource", + "value": "custom_code" + }, + { + "name": "quantum:sourcePackage", + "value": "Unable to determine, no stack trace provided" + }, + { + "name": "quantum:remediationOwner", + "value": "N/A, no fix required for quantum resistance" + }, + { + "name": "quantum:quantumThreat", + "value": "AES-GCM is a symmetric algorithm. Grover\u0027s Algorithm only reduces its effective security by half, so AES-256-GCM remains at 128-bit security post-quantum, still considered secure. If this is AES-128-GCM, it would drop to an effective 64-bit security level, which is a concern independent of quantum computing and should be reviewed for key size." + }, + { + "name": "quantum:recommendation", + "value": "Confirm the key size in use. If AES-256, no action is needed for quantum resistance. If AES-128, plan to upgrade to AES-256 to maintain long-term security margins, though this is a classical strength issue, not a quantum-specific one." + }, + { + "name": "quantum:migrationNotes", + "value": "No stack trace was provided in this instance, so the specific code location and key size could not be verified. Request the full stack trace and confirm the key length parameter passed to Cipher.getInstance or equivalent key generation call before closing this out." + }, + { + "name": "quantum:findingsAnalyzed", + "value": "2" + } + ], + "evidence": { + "occurrences": [ + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-dataservice" + }, + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" + } + ] + }, + "cryptoProperties": { + "assetType": "algorithm", + "algorithmProperties": { + "primitive": "ae", + "parameterSetIdentifier": "128", + "mode": "gcm", + "padding": "raw", + "cryptoFunctions": [ + "encrypt", + "decrypt", + "keygen" + ], + "classicalSecurityLevel": 128, + "nistQuantumSecurityLevel": 1 + }, + "oid": "2.16.840.1.101.3.4.1.6" + } + }, + { + "type": "application", + "bom-ref": "app-cargo-crypto-contrast-cargo-cats-dataservice", + "name": "Cargo-Crypto-contrast-cargo-cats-dataservice", + "description": "Based on its name, this is likely a data service component for an application called \"Cargo Cats,\" probably handling data persistence or retrieval for that system. With no observed connections or third-party libraries, it may be a newly instrumented, isolated, or lightly-used service, so this description should be treated as a low-confidence guess rather than a confirmed architectural role." + }, + { + "type": "application", + "bom-ref": "app-cargo-crypto-contrast-cargo-cats-frontgateservice", + "name": "Cargo-Crypto-contrast-cargo-cats-frontgateservice", + "description": "Based on its name, this is most likely the front-facing API gateway for the \"Cargo Cats\" application suite, handling inbound traffic and routing requests toward backend services. Since no connected applications or third-party libraries were observed, its architecture graph data is likely incomplete or it operates in isolation from the instrumented environment." + } + ], + "dependencies": [ + { + "ref": "app-cargo-crypto-contrast-cargo-cats-dataservice", + "dependsOn": [ + "crypto-sha-256", + "crypto-md5", + "crypto-aes-gcm-nopadding" + ] + }, + { + "ref": "app-cargo-crypto-contrast-cargo-cats-frontgateservice", + "dependsOn": [ + "crypto-sha-1", + "crypto-sha-256", + "crypto-aes-gcm-nopadding", + "crypto-md5" + ] + }, + { + "ref": "contrast-crypto-inventory", + "dependsOn": [ + "app-cargo-crypto-contrast-cargo-cats-dataservice", + "app-cargo-crypto-contrast-cargo-cats-frontgateservice" + ] + } + ] +} \ No newline at end of file diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md new file mode 100644 index 0000000..eec8145 --- /dev/null +++ b/samples/sample-vex-advisor.md @@ -0,0 +1,533 @@ + + +# Contrast VEX Advisor +## Review of Automatically-Generated VEX Claims + +--- + +**Report Date:** September 2, 2026 +**Assessment Type:** VEX Claim Soundness Review + +--- + +## Executive Summary + +This report reviews VEX (Vulnerability Exploitability eXchange) claims generated from Contrast Security runtime library-usage and CVE Shield/Protect data. It does not re-derive whether a CVE exists - it judges whether each `not_affected`/`in_triage` claim is well-supported enough to rely on as-is, or whether a human should look at it first. + +**1** application(s), **235** VEX statement(s) reviewed. + +> **124 claim(s) flagged for human review** before relying on them. + +### Applications + +| Application | Risk Level | Statements | +|-------------|------------|------------| +| SAML-PetClinic-Demo | CRITICAL | 235 | + +| Risk Level | Applications | +|------------|--------------| +| CRITICAL | 1 | + +--- + +## Application Review + +### SAML-PetClinic-Demo + +**Risk Level:** CRITICAL + +SAML-PetClinic-Demo has roughly 235 VEX claims spanning ~35 libraries, almost entirely 'not_affected' with either code_not_reachable (genuinely sound, ~90 claims) or 288-day duration-based absence-of-execution reasoning (~145 claims). The duration-based claims comfortably clear the 30-day policy threshold, but a large share of them cover critical/high severity CVEs -including six tied to CISA KEV entries (Spring4Shell CVE-2022-22965 x2 duration-based, Tomcat Ghostcat CVE-2020-1938, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487) - so the overall posture leans on probabilistic reasoning for its riskiest findings. + +**Risk Rationale:** Multiple actively-exploited (KEV) critical CVEs - notably CVE-2022-22965 (Spring4Shell) on spring-webmvc and spring-beans, and CVE-2020-1938/CVE-2025-24813/CVE-2017-12617/CVE-2023-44487 on tomcat-embed-core - are marked not_affected solely on 'no observed execution in 288 days,' not structural non-reachability, despite the libraries being substantially loaded (up to 387 of 1481 classes for tomcat, 166/498 for spring-webmvc). Dozens more critical/high jackson-databind, spring-core/web/expression, thymeleaf, and hsqldb CVEs follow the same pattern. These are exactly the claims the review criteria flag as weakest: severe, exploitable CVEs accepted on absence of evidence rather than proof of unreachability. + +**Recommendation:** Prioritize human review of the KEV-tagged claims first (CVE-2022-22965 on spring-webmvc/spring-beans, CVE-2020-1938, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487 on tomcat-embed-core, CVE-2018-1273 on spring-data-commons), then work through the remaining critical/high duration-only claims on jackson-databind, thymeleaf, spring-core/web/expression, hsqldb, dom4j, and mysql-connector-java. code_not_reachable claims (snakeyaml, netty, jetty-http, htmlunit, plexus-utils, commons-compress, bootstrap, junit, commons-lang/commons-lang3, commons-io, httpclient) can be trusted as-is; medium/low severity duration-based claims are acceptable without further review. + +#### VEX Statements + +| CVE | Library | Severity | State | Assessment | +|-----|---------|----------|-------|------------| +| CVE-2018-14721 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2018-11307 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2017-17485 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2020-8840 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2019-16335 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2019-20330 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2018-14718 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2018-14720 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2018-14719 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2020-9548 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2019-14540 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2020-9547 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2019-14892 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2019-16942 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2018-19361 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2019-16943 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2018-19360 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2018-19362 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2019-17267 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2017-7525 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2018-7489 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2019-17531 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2017-15095 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2019-14379 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | +| CVE-2020-10673 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-35728 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-35491 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-35490 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36184 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36182 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36180 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36186 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36181 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36179 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-10650 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36185 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36188 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36187 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36189 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36183 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2021-20190 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2018-5968 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-24616 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-24750 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2022-42004 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2022-42003 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-25649 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2018-12023 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2020-36518 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2019-14439 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2018-12022 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2019-12086 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | +| CVE-2019-12384 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | medium | not_affected | sound | +| CVE-2019-12814 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | medium | not_affected | sound | +| CVE-2023-26119 | `pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21` | critical | not_affected | sound | +| CVE-2020-5529 | `pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21` | high | not_affected | sound | +| CVE-2020-10683 | `pkg:maven/dom4j/dom4j@1.6.1` | critical | not_affected | needs_review | +| CVE-2018-1000632 | `pkg:maven/dom4j/dom4j@1.6.1` | high | not_affected | needs_review | +| CVE-2022-1471 | `pkg:maven/org.yaml/snakeyaml@1.17` | critical | not_affected | sound | +| CVE-2022-25857 | `pkg:maven/org.yaml/snakeyaml@1.17` | high | not_affected | sound | +| CVE-2017-18640 | `pkg:maven/org.yaml/snakeyaml@1.17` | high | not_affected | sound | +| CVE-2022-38749 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | sound | +| CVE-2022-41854 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | sound | +| CVE-2022-38751 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | sound | +| CVE-2022-38752 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | sound | +| CVE-2022-38750 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | sound | +| CVE-2022-22965 | `pkg:maven/org.springframework.boot/spring-boot-starter-web@1.5.4.RELEASE` | critical | not_affected | needs_review | +| CVE-2018-1273 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | critical | not_affected | needs_review | +| CVE-2018-1274 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | high | not_affected | needs_review | +| CVE-2026-41716 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | high | not_affected | needs_review | +| CVE-2026-41721 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | medium | not_affected | sound | +| CVE-2026-41711 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | medium | not_affected | sound | +| CVE-2018-1259 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | unknown | not_affected | sound | +| CVE-2022-41853 | `pkg:maven/org.hsqldb/hsqldb@2.3.5` | critical | not_affected | needs_review | +| CVE-2017-5929 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | critical | not_affected | needs_review | +| CVE-2023-6378 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | high | not_affected | needs_review | +| CVE-2021-42550 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | medium | not_affected | sound | +| CVE-2026-10532 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | +| CVE-2026-1225 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | +| CVE-2026-9828 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | +| CVE-2025-11226 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | +| CVE-2024-12798 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | +| CVE-2024-12801 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | +| CVE-2016-1000027 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | critical | not_affected | needs_review | +| CVE-2024-22243 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2024-22262 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2024-22259 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2018-11039 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2024-38820 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2024-38809 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2022-22965 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | critical | not_affected | needs_review | +| CVE-2026-41842 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2024-38819 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2026-41845 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2026-41846 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2026-41844 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2026-41841 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2026-41843 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2026-22745 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2026-41853 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2026-22741 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | low | not_affected | sound | +| CVE-2017-5929 | `pkg:maven/ch.qos.logback/logback-classic@1.1.11` | critical | not_affected | needs_review | +| CVE-2023-6378 | `pkg:maven/ch.qos.logback/logback-classic@1.1.11` | high | not_affected | needs_review | +| CVE-2022-22965 | `pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE` | critical | not_affected | needs_review | +| CVE-2022-22970 | `pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2018-8014 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | +| CVE-2025-24813 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | +| CVE-2026-43512 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | +| CVE-2020-1938 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | +| CVE-2025-31651 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | +| CVE-2024-50379 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | +| CVE-2026-43515 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | +| CVE-2019-0232 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2017-12617 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2019-0199 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2018-8034 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2019-17563 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2023-46589 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2025-55752 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2026-41284 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2019-10072 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2026-43513 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2021-25122 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2024-34750 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2025-48988 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2025-49125 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2025-52434 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2022-42252 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2025-53506 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2025-52520 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2025-31650 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2024-24549 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2023-44487 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2018-1336 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2025-46701 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2019-12418 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2021-25329 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2020-9484 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | +| CVE-2018-1305 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | +| CVE-2019-0221 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | +| CVE-2021-24122 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | +| CVE-2018-8037 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | +| CVE-2018-1304 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | +| CVE-2025-61795 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | +| CVE-2024-21733 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | +| CVE-2023-42795 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | +| CVE-2018-11784 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | +| CVE-2017-1000487 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | critical | not_affected | sound | +| CVE-2025-67030 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | high | not_affected | sound | +| CVE-2022-4244 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | high | not_affected | sound | +| CVE-2022-4245 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | medium | not_affected | sound | +| CVE-2019-20445 | `pkg:maven/io.netty/netty@3.5.7.Final` | critical | not_affected | sound | +| CVE-2019-20444 | `pkg:maven/io.netty/netty@3.5.7.Final` | critical | not_affected | sound | +| CVE-2021-37136 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | sound | +| CVE-2021-37137 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | sound | +| CVE-2019-16869 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | sound | +| CVE-2021-43797 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | sound | +| CVE-2021-21409 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | sound | +| CVE-2021-21295 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | sound | +| CVE-2021-21290 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | sound | +| CVE-2015-2156 | `pkg:maven/io.netty/netty@3.5.7.Final` | unknown | not_affected | sound | +| CVE-2026-2332 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | critical | not_affected | sound | +| CVE-2025-11143 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | sound | +| CVE-2024-6763 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | sound | +| CVE-2023-40167 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | sound | +| CVE-2022-2047 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | low | not_affected | sound | +| CVE-2026-41901 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | needs_review | +| CVE-2026-40477 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | needs_review | +| CVE-2026-40478 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | needs_review | +| CVE-2018-3258 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | high | not_affected | needs_review | +| CVE-2023-22102 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | high | not_affected | needs_review | +| CVE-2019-2692 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | medium | not_affected | sound | +| CVE-2022-21363 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | unknown | not_affected | sound | +| CVE-2026-22733 | `pkg:maven/org.springframework.boot/spring-boot-starter-actuator@1.5.4.RELEASE` | high | not_affected | sound | +| CVE-2022-27772 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | needs_review | +| CVE-2025-22235 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | needs_review | +| CVE-2026-40973 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | needs_review | +| CVE-2018-1196 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | medium | not_affected | sound | +| CVE-2022-28366 | `pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21` | high | not_affected | sound | +| CVE-2022-29546 | `pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21` | high | not_affected | sound | +| CVE-2022-25647 | `pkg:maven/com.google.code.gson/gson@2.8.0` | high | not_affected | needs_review | +| CVE-2021-36090 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | sound | +| CVE-2021-35516 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | sound | +| CVE-2021-35517 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | sound | +| CVE-2021-35515 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | sound | +| CVE-2024-25710 | `pkg:maven/org.apache.commons/commons-compress@1.9` | medium | not_affected | sound | +| CVE-2018-11771 | `pkg:maven/org.apache.commons/commons-compress@1.9` | medium | not_affected | sound | +| CVE-2022-34169 | `pkg:maven/xalan/xalan@2.7.2` | high | not_affected | needs_review | +| CVE-2018-1272 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2018-15756 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2026-41848 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2018-11040 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2018-1257 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2018-1271 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2018-1199 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2021-22096 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2026-41850 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2026-41851 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2026-41849 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | needs_review | +| CVE-2023-20863 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2023-20861 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2022-22950 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2026-41852 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2024-38808 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2023-20883 | `pkg:maven/org.springframework.boot/spring-boot-autoconfigure@1.5.4.RELEASE` | high | not_affected | needs_review | +| CVE-2024-23672 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15` | medium | not_affected | sound | +| CVE-2020-25638 | `pkg:maven/org.hibernate/hibernate-core@5.0.4.Final` | high | not_affected | needs_review | +| CVE-2019-14900 | `pkg:maven/org.hibernate/hibernate-core@5.0.4.Final` | medium | not_affected | sound | +| CVE-2017-7536 | `pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final` | high | not_affected | needs_review | +| CVE-2023-2976 | `pkg:maven/com.google.guava/guava@19.0` | high | not_affected | needs_review | +| CVE-2020-8908 | `pkg:maven/com.google.guava/guava@19.0` | low | not_affected | sound | +| CVE-2012-0881 | `pkg:maven/xerces/xercesimpl@2.11.0` | unknown | not_affected | sound | +| CVE-2013-4002 | `pkg:maven/xerces/xercesimpl@2.11.0` | unknown | not_affected | sound | +| CVE-2022-23437 | `pkg:maven/xerces/xercesimpl@2.11.0` | medium | not_affected | sound | +| CVE-2020-14338 | `pkg:maven/xerces/xercesimpl@2.11.0` | medium | not_affected | sound | +| CVE-2023-34055 | `pkg:maven/org.springframework.boot/spring-boot-actuator@1.5.4.RELEASE` | medium | not_affected | sound | +| CVE-2018-14042 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | +| CVE-2018-14040 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | +| CVE-2016-10735 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | +| CVE-2019-8331 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | +| CVE-2018-20677 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | +| CVE-2018-20676 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | +| CVE-2020-15250 | `pkg:maven/junit/junit@4.12` | medium | not_affected | sound | +| CVE-2025-48924 | `pkg:maven/commons-lang/commons-lang@2.6` | medium | not_affected | sound | +| CVE-2025-48924 | `pkg:maven/org.apache.commons/commons-lang3@3.1` | medium | not_affected | sound | +| CVE-2019-3797 | `pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE` | medium | not_affected | sound | +| CVE-2019-3802 | `pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE` | medium | not_affected | sound | +| CVE-2022-22968 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2024-38820 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | medium | not_affected | sound | +| CVE-2025-22233 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | low | not_affected | sound | +| CVE-2020-13956 | `pkg:maven/org.apache.httpcomponents/httpclient@4.5.3` | medium | not_affected | sound | +| CVE-2021-29425 | `pkg:maven/commons-io/commons-io@2.4` | medium | not_affected | sound | +| CVE-2024-47554 | `pkg:maven/commons-io/commons-io@2.4` | medium | not_affected | sound | +| CVE-2025-49128 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8` | medium | not_affected | sound | +| CVE-2025-52999 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8` | unknown | not_affected | sound | + +- **CVE-2018-14721** (needs_review): Critical (10.0) jackson-databind CVE accepted purely on 288 days without observed execution, not structural unreachability. +- **CVE-2018-11307** (needs_review): Critical severity, duration-only justification on a partially-loaded library (263/582 classes). +- **CVE-2017-17485** (needs_review): Critical, EPSS 0.5 (high exploit likelihood), duration-only acceptance is weak evidence for this deserialization CVE. +- **CVE-2020-8840** (needs_review): Critical jackson-databind gadget-chain CVE relying only on absence-of-observed-execution. +- **CVE-2019-16335** (needs_review): Critical severity, duration-only reasoning, library actively loaded. +- **CVE-2019-20330** (needs_review): Critical severity accepted on runtime silence alone. +- **CVE-2018-14718** (needs_review): Critical jackson-databind deserialization CVE, duration-only justification. +- **CVE-2018-14720** (needs_review): Critical severity, no structural reachability guarantee provided. +- **CVE-2018-14719** (needs_review): Critical severity, absence-of-execution is the sole basis for not_affected. +- **CVE-2020-9548** (needs_review): Critical severity, duration-based claim on library with substantial class usage. +- **CVE-2019-14540** (needs_review): Critical severity jackson-databind CVE, duration-only reasoning. +- **CVE-2020-9547** (needs_review): Critical severity, duration-only justification. +- **CVE-2019-14892** (needs_review): Critical severity, no code_not_reachable or protected_at_runtime backing. +- **CVE-2019-16942** (needs_review): Critical severity gadget-chain CVE accepted on runtime silence alone. +- **CVE-2018-19361** (needs_review): Critical severity, duration-only reasoning. +- **CVE-2019-16943** (needs_review): Critical severity, duration-only justification. +- **CVE-2018-19360** (needs_review): Critical severity, absence-of-evidence acceptance. +- **CVE-2018-19362** (needs_review): Critical severity, duration-only justification. +- **CVE-2019-17267** (needs_review): Critical severity gadget-chain CVE, no structural guarantee. +- **CVE-2017-7525** (needs_review): Critical, EPSS 0.38, duration-only reasoning on a well-known deserialization CVE. +- **CVE-2018-7489** (needs_review): Critical severity, EPSS 0.2, duration-only justification. +- **CVE-2019-17531** (needs_review): Critical severity, no structural reachability evidence. +- **CVE-2017-15095** (needs_review): Critical severity, duration-only acceptance. +- **CVE-2019-14379** (needs_review): Critical severity jackson-databind CVE, duration-only justification. +- **CVE-2020-10673** (needs_review): High severity (8.8), duration-only reasoning without structural backing. +- **CVE-2020-35728** (needs_review): High severity, duration-only justification. +- **CVE-2020-35491** (needs_review): High severity, duration-only justification. +- **CVE-2020-35490** (needs_review): High severity, duration-only justification. +- **CVE-2020-36184** (needs_review): High severity, duration-only justification. +- **CVE-2020-36182** (needs_review): High severity, duration-only justification. +- **CVE-2020-36180** (needs_review): High severity, duration-only justification. +- **CVE-2020-36186** (needs_review): High severity, duration-only justification. +- **CVE-2020-36181** (needs_review): High severity, duration-only justification. +- **CVE-2020-36179** (needs_review): High severity, duration-only justification. +- **CVE-2020-10650** (needs_review): High severity, duration-only justification. +- **CVE-2020-36185** (needs_review): High severity, duration-only justification. +- **CVE-2020-36188** (needs_review): High severity, duration-only justification. +- **CVE-2020-36187** (needs_review): High severity, duration-only justification. +- **CVE-2020-36189** (needs_review): High severity, duration-only justification. +- **CVE-2020-36183** (needs_review): High severity, duration-only justification. +- **CVE-2021-20190** (needs_review): High severity, duration-only justification. +- **CVE-2018-5968** (needs_review): High severity, duration-only justification. +- **CVE-2020-24616** (needs_review): High severity, duration-only justification. +- **CVE-2020-24750** (needs_review): High severity, duration-only justification. +- **CVE-2022-42004** (needs_review): High severity, duration-only justification. +- **CVE-2022-42003** (needs_review): High severity, duration-only justification. +- **CVE-2020-25649** (needs_review): High severity, duration-only justification. +- **CVE-2018-12023** (needs_review): High severity, duration-only justification. +- **CVE-2020-36518** (needs_review): High severity, duration-only justification. +- **CVE-2019-14439** (needs_review): High severity, duration-only justification. +- **CVE-2018-12022** (needs_review): High severity, duration-only justification. +- **CVE-2019-12086** (needs_review): High severity, EPSS 0.22, duration-only justification. +- **CVE-2019-12384** (sound): Medium severity; duration-based acceptance is acceptable at this stakes level. +- **CVE-2019-12814** (sound): Medium severity; duration-based acceptance is reasonable. +- **CVE-2023-26119** (sound): code_not_reachable with 0 of 1295 classes loaded is a structural fact, safe regardless of critical severity. +- **CVE-2020-5529** (sound): code_not_reachable, structural non-reachability, safe to rely on. +- **CVE-2020-10683** (needs_review): Critical severity dom4j XXE CVE accepted on duration alone; only 1 of 190 classes loaded but that single class could be the vulnerable path. +- **CVE-2018-1000632** (needs_review): High severity, duration-only justification with minimal (1/190) class usage - worth confirming that one class isn't the vulnerable path. +- **CVE-2022-1471** (sound): code_not_reachable (0 of 206 classes) is structural, safe despite critical severity/EPSS 1.0. +- **CVE-2022-25857** (sound): code_not_reachable, structural non-reachability. +- **CVE-2017-18640** (sound): code_not_reachable, structural non-reachability. +- **CVE-2022-38749** (sound): code_not_reachable, medium severity, low stakes. +- **CVE-2022-41854** (sound): code_not_reachable, medium severity. +- **CVE-2022-38751** (sound): code_not_reachable, medium severity. +- **CVE-2022-38752** (sound): code_not_reachable, medium severity. +- **CVE-2022-38750** (sound): code_not_reachable, medium severity. +- **CVE-2022-22965** (needs_review): For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes). +- **CVE-2018-1273** (needs_review): Critical, KEV-listed, EPSS 0.97 spring-data-commons RCE accepted purely on duration with the library substantially loaded (152/554 classes) - high priority for human review. +- **CVE-2018-1274** (needs_review): High severity, duration-only justification on same actively-loaded library. +- **CVE-2026-41716** (needs_review): High severity CVE accepted on duration alone, though EPSS is negligible. +- **CVE-2026-41721** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2026-41711** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2018-1259** (sound): Unknown/no severity score, low stakes. +- **CVE-2022-41853** (needs_review): Critical severity hsqldb CVE accepted purely on duration, library substantially loaded (229/601 classes). +- **CVE-2017-5929** (needs_review): For logback-classic: critical severity, duration-only justification with library actively loaded (63/178 classes). +- **CVE-2023-6378** (needs_review): For logback-classic: high severity, duration-only justification. +- **CVE-2021-42550** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2026-10532** (sound): Unknown severity, low stakes. +- **CVE-2026-1225** (sound): Unknown severity, low stakes. +- **CVE-2026-9828** (sound): Unknown severity, low stakes. +- **CVE-2025-11226** (sound): Unknown severity, low stakes. +- **CVE-2024-12798** (sound): Unknown severity, low stakes. +- **CVE-2024-12801** (sound): Unknown severity, low stakes. +- **CVE-2016-1000027** (needs_review): Critical severity spring-web CVE, EPSS 0.32, duration-only justification. +- **CVE-2024-22243** (needs_review): High severity, duration-only justification. +- **CVE-2024-22262** (needs_review): High severity, duration-only justification. +- **CVE-2024-22259** (needs_review): High severity, duration-only justification. +- **CVE-2018-11039** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2024-38820** (sound): For spring-context: medium severity, duration-based acceptance reasonable. +- **CVE-2024-38809** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2022-22965** (needs_review): For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes). +- **CVE-2026-41842** (needs_review): High severity, duration-only justification. +- **CVE-2024-38819** (needs_review): High severity, EPSS 0.55, duration-only justification. +- **CVE-2026-41845** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2026-41846** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2026-41844** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2026-41841** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2026-41843** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2026-22745** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2026-41853** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2026-22741** (sound): Low severity, duration-based acceptance is fine. +- **CVE-2017-5929** (needs_review): For logback-classic: critical severity, duration-only justification with library actively loaded (63/178 classes). +- **CVE-2023-6378** (needs_review): For logback-classic: high severity, duration-only justification. +- **CVE-2022-22965** (needs_review): For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes). +- **CVE-2022-22970** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2018-8014** (needs_review): Critical severity tomcat-embed-core CVE, duration-only justification, library heavily loaded (387/1481 classes). +- **CVE-2025-24813** (needs_review): Critical, KEV-listed, EPSS 1.0 Tomcat path equality RCE accepted purely on duration despite heavy library usage - top priority review. +- **CVE-2026-43512** (needs_review): Critical severity, duration-only justification. +- **CVE-2020-1938** (needs_review): Critical, KEV-listed (Ghostcat), EPSS 0.99, accepted purely on duration - top priority review. +- **CVE-2025-31651** (needs_review): Critical severity, duration-only justification. +- **CVE-2024-50379** (needs_review): Critical severity, EPSS 0.44, duration-only justification. +- **CVE-2026-43515** (needs_review): Critical severity, duration-only justification. +- **CVE-2019-0232** (needs_review): High severity, EPSS 1.0, duration-only justification. +- **CVE-2017-12617** (needs_review): High severity, KEV-listed, EPSS 1.0, duration-only justification - top priority review. +- **CVE-2019-0199** (needs_review): High severity, EPSS 0.73, duration-only justification. +- **CVE-2018-8034** (needs_review): High severity, duration-only justification. +- **CVE-2019-17563** (needs_review): High severity, duration-only justification. +- **CVE-2023-46589** (needs_review): High severity, duration-only justification. +- **CVE-2025-55752** (needs_review): High severity, EPSS 0.67, duration-only justification. +- **CVE-2026-41284** (needs_review): High severity, duration-only justification. +- **CVE-2019-10072** (needs_review): High severity, EPSS 0.73, duration-only justification. +- **CVE-2026-43513** (needs_review): High severity, duration-only justification. +- **CVE-2021-25122** (needs_review): High severity, duration-only justification. +- **CVE-2024-34750** (needs_review): High severity, duration-only justification. +- **CVE-2025-48988** (needs_review): High severity, EPSS 0.57, duration-only justification. +- **CVE-2025-49125** (needs_review): High severity, duration-only justification. +- **CVE-2025-52434** (needs_review): High severity, duration-only justification. +- **CVE-2022-42252** (needs_review): High severity, duration-only justification. +- **CVE-2025-53506** (needs_review): High severity, duration-only justification. +- **CVE-2025-52520** (needs_review): High severity, duration-only justification. +- **CVE-2025-31650** (needs_review): High severity, EPSS 0.6, duration-only justification. +- **CVE-2024-24549** (needs_review): High severity, EPSS 0.23, duration-only justification. +- **CVE-2023-44487** (needs_review): High severity, KEV-listed (HTTP/2 Rapid Reset), EPSS 1.0, duration-only justification - priority review. +- **CVE-2018-1336** (needs_review): High severity, duration-only justification. +- **CVE-2025-46701** (needs_review): High severity, duration-only justification. +- **CVE-2019-12418** (needs_review): High severity, duration-only justification. +- **CVE-2021-25329** (needs_review): High severity, duration-only justification. +- **CVE-2020-9484** (needs_review): High severity, EPSS 0.57, duration-only justification. +- **CVE-2018-1305** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2019-0221** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2021-24122** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2018-8037** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2018-1304** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2025-61795** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2024-21733** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2023-42795** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2018-11784** (sound): Medium severity; despite unusually high EPSS (0.94), lower stakes than critical/high per policy, acceptable on duration. +- **CVE-2017-1000487** (sound): code_not_reachable, structural non-reachability, safe despite critical severity. +- **CVE-2025-67030** (sound): code_not_reachable, structural non-reachability. +- **CVE-2022-4244** (sound): code_not_reachable, structural non-reachability. +- **CVE-2022-4245** (sound): code_not_reachable, structural non-reachability. +- **CVE-2019-20445** (sound): code_not_reachable, structural non-reachability, safe despite critical severity. +- **CVE-2019-20444** (sound): code_not_reachable, structural non-reachability. +- **CVE-2021-37136** (sound): code_not_reachable, structural non-reachability. +- **CVE-2021-37137** (sound): code_not_reachable, structural non-reachability. +- **CVE-2019-16869** (sound): code_not_reachable, structural non-reachability. +- **CVE-2021-43797** (sound): code_not_reachable, structural non-reachability. +- **CVE-2021-21409** (sound): code_not_reachable, structural non-reachability. +- **CVE-2021-21295** (sound): code_not_reachable, structural non-reachability. +- **CVE-2021-21290** (sound): code_not_reachable, structural non-reachability. +- **CVE-2015-2156** (sound): code_not_reachable, structural non-reachability. +- **CVE-2026-2332** (sound): code_not_reachable, structural non-reachability, safe despite critical severity. +- **CVE-2025-11143** (sound): code_not_reachable, structural non-reachability. +- **CVE-2024-6763** (sound): code_not_reachable, structural non-reachability. +- **CVE-2023-40167** (sound): code_not_reachable, structural non-reachability. +- **CVE-2022-2047** (sound): code_not_reachable, structural non-reachability. +- **CVE-2026-41901** (needs_review): Critical severity thymeleaf CVE, duration-only justification, library heavily loaded (367/549 classes). +- **CVE-2026-40477** (needs_review): Critical severity, duration-only justification. +- **CVE-2026-40478** (needs_review): Critical severity, duration-only justification. +- **CVE-2018-3258** (needs_review): High severity mysql-connector CVE, duration-only justification. +- **CVE-2023-22102** (needs_review): High severity, duration-only justification. +- **CVE-2019-2692** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2022-21363** (sound): Unknown severity, low stakes. +- **CVE-2026-22733** (sound): code_not_reachable (0 of 0 classes), consistent with starter POM containing no code, safe despite high severity. +- **CVE-2022-27772** (needs_review): High severity spring-boot CVE, duration-only justification. +- **CVE-2025-22235** (needs_review): High severity, duration-only justification. +- **CVE-2026-40973** (needs_review): High severity, duration-only justification. +- **CVE-2018-1196** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2022-28366** (sound): code_not_reachable, structural non-reachability. +- **CVE-2022-29546** (sound): code_not_reachable, structural non-reachability. +- **CVE-2022-25647** (needs_review): High severity gson CVE, duration-only justification with library actively loaded (36/174 classes). +- **CVE-2021-36090** (sound): code_not_reachable, structural non-reachability. +- **CVE-2021-35516** (sound): code_not_reachable, structural non-reachability. +- **CVE-2021-35517** (sound): code_not_reachable, structural non-reachability. +- **CVE-2021-35515** (sound): code_not_reachable, structural non-reachability. +- **CVE-2024-25710** (sound): code_not_reachable, medium severity. +- **CVE-2018-11771** (sound): code_not_reachable, medium severity. +- **CVE-2022-34169** (needs_review): High severity, EPSS 0.81 xalan CVE, duration-only justification despite very low class usage (7/1501) - worth confirming those 7 classes aren't the vulnerable path. +- **CVE-2018-1272** (needs_review): High severity spring-core CVE, duration-only justification, library heavily loaded (334/791 classes). +- **CVE-2018-15756** (needs_review): High severity, duration-only justification. +- **CVE-2026-41848** (needs_review): High severity, duration-only justification. +- **CVE-2018-11040** (needs_review): High severity, duration-only justification. +- **CVE-2018-1257** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2018-1271** (sound): Medium severity, duration-based acceptance reasonable despite elevated EPSS (0.35). +- **CVE-2018-1199** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2021-22096** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2026-41850** (needs_review): High severity spring-expression CVE, duration-only justification, library heavily loaded (91/142 classes). +- **CVE-2026-41851** (needs_review): High severity, duration-only justification. +- **CVE-2026-41849** (needs_review): High severity, duration-only justification. +- **CVE-2023-20863** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2023-20861** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2022-22950** (sound): Medium severity, duration-based acceptance reasonable despite EPSS 0.36. +- **CVE-2026-41852** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2024-38808** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2023-20883** (needs_review): High severity spring-boot-autoconfigure CVE, duration-only justification, library well-loaded (195/848 classes). +- **CVE-2024-23672** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2020-25638** (needs_review): High severity hibernate-core CVE, duration-only justification, library heavily loaded (1563/3787 classes). +- **CVE-2019-14900** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2017-7536** (needs_review): High severity hibernate-validator CVE, duration-only justification, library well-loaded (225/459 classes). +- **CVE-2023-2976** (needs_review): High severity guava CVE, duration-only justification, though usage is minimal (5/1717 classes). +- **CVE-2020-8908** (sound): Low severity, duration-based acceptance reasonable. +- **CVE-2012-0881** (sound): Unknown severity, low stakes. +- **CVE-2013-4002** (sound): Unknown severity, low stakes. +- **CVE-2022-23437** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2020-14338** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2023-34055** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2018-14042** (sound): code_not_reachable, structural non-reachability. +- **CVE-2018-14040** (sound): code_not_reachable, structural non-reachability. +- **CVE-2016-10735** (sound): code_not_reachable, structural non-reachability. +- **CVE-2019-8331** (sound): code_not_reachable, structural non-reachability. +- **CVE-2018-20677** (sound): code_not_reachable, structural non-reachability. +- **CVE-2018-20676** (sound): code_not_reachable, structural non-reachability. +- **CVE-2020-15250** (sound): code_not_reachable, structural non-reachability (test-scope library). +- **CVE-2025-48924** (sound): For commons-lang3: code_not_reachable, structural non-reachability. +- **CVE-2025-48924** (sound): For commons-lang3: code_not_reachable, structural non-reachability. +- **CVE-2019-3797** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2019-3802** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2022-22968** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2024-38820** (sound): For spring-context: medium severity, duration-based acceptance reasonable. +- **CVE-2025-22233** (sound): Low severity, duration-based acceptance reasonable. +- **CVE-2020-13956** (sound): code_not_reachable, structural non-reachability. +- **CVE-2021-29425** (sound): code_not_reachable, structural non-reachability. +- **CVE-2024-47554** (sound): code_not_reachable, structural non-reachability. +- **CVE-2025-49128** (sound): Medium severity, duration-based acceptance reasonable. +- **CVE-2025-52999** (sound): Unknown severity, low stakes. + +--- + +## Appendix: Methodology + +VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This advisor does not change any claim; it only assesses whether relying on each claim as generated is reasonable given the CVE's severity and exploitability. + +- **sound**: the claim's justification (structural fact or active control) supports relying on it as-is +- **needs_review**: the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or is otherwise borderline - a human should confirm before treating it as resolved + +--- + +*Report generated by Contrast VEX Advisor* +*Powered by Contrast Security Runtime Observability* diff --git a/samples/sample-vex.json b/samples/sample-vex.json new file mode 100644 index 0000000..fd44abe --- /dev/null +++ b/samples/sample-vex.json @@ -0,0 +1,25739 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "version": 1, + "metadata": { + "timestamp": "2026-09-02T21:36:56Z", + "component": { + "type": "application", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", + "name": "SAML-PetClinic-Demo" + } + }, + "vulnerabilities": [ + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14721-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-14721", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14721" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14721" + }, + "score": 10.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-14721. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.1" + }, + { + "name": "contrast:epssPercentile", + "value": "95.42" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical (10.0) jackson-databind CVE accepted purely on 288 days without observed execution, not structural unreachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11307-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-11307", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11307" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11307" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-11307. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "92.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only justification on a partially-loaded library (263/582 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-17485-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2017-17485", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2017-17485. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.5" + }, + { + "name": "contrast:epssPercentile", + "value": "98.81" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical, EPSS 0.5 (high exploit likelihood), duration-only acceptance is weak evidence for this deserialization CVE." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-8840-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-8840", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-8840. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.27" + }, + { + "name": "contrast:epssPercentile", + "value": "97.87" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical jackson-databind gadget-chain CVE relying only on absence-of-observed-execution." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16335-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-16335", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16335" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16335" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-16335. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.58" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only reasoning, library actively loaded." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20330-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-20330", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20330" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20330" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-20330. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "94.72" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity accepted on runtime silence alone." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14718-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-14718", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14718" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14718" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-14718. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.13" + }, + { + "name": "contrast:epssPercentile", + "value": "95.98" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical jackson-databind deserialization CVE, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14720-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-14720", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14720" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14720" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-14720. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.07" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, no structural reachability guarantee provided." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14719-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-14719", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14719" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14719" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-14719. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.1" + }, + { + "name": "contrast:epssPercentile", + "value": "95.16" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, absence-of-execution is the sole basis for not_affected." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-9548-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-9548", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-9548. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.18" + }, + { + "name": "contrast:epssPercentile", + "value": "97.02" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-based claim on library with substantial class usage." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14540-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-14540", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14540" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14540" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-14540. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity jackson-databind CVE, duration-only reasoning." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-9547-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-9547", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-9547. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.18" + }, + { + "name": "contrast:epssPercentile", + "value": "97.03" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14892-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-14892", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14892" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14892" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-14892. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "92.41" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, no code_not_reachable or protected_at_runtime backing." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16942-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-16942", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16942" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16942" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-16942. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "92.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity gadget-chain CVE accepted on runtime silence alone." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-19361-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-19361", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19361" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19361" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-19361. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only reasoning." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16943-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-16943", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16943" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16943" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-16943. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.49" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-19360-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-19360", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19360" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19360" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-19360. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, absence-of-evidence acceptance." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-19362-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-19362", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19362" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19362" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-19362. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-17267-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-17267", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17267" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17267" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-17267. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.07" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity gadget-chain CVE, no structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-7525-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2017-7525", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7525" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7525" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2017-7525. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.38" + }, + { + "name": "contrast:epssPercentile", + "value": "98.44" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical, EPSS 0.38, duration-only reasoning on a well-known deserialization CVE." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-7489-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-7489", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-7489. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.2" + }, + { + "name": "contrast:epssPercentile", + "value": "97.22" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, EPSS 0.2, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-17531-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-17531", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17531" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17531" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-17531. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "92.1" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, no structural reachability evidence." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-15095-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2017-15095", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15095" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15095" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously. \\", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2017-15095. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.56" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only acceptance." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14379-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-14379", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14379" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14379" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-14379. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.43" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity jackson-databind CVE, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-10673-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-10673", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10673" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10673" + }, + "score": 8.8, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-10673. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.37" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity (8.8), duration-only reasoning without structural backing." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-35728-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-35728", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35728" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35728" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-35728. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.13" + }, + { + "name": "contrast:epssPercentile", + "value": "95.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-35491-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-35491", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35491" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35491" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-35491. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "95.08" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-35490-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-35490", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35490" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35490" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-35490. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.18" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36184-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36184", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36184" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36184" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36184. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.1" + }, + { + "name": "contrast:epssPercentile", + "value": "95.4" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36182-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36182", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36182" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36182" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36182. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.66" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36180-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36180", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36180" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36180" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36180. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.7" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36186-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36186", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36186" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36186" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36186. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36181-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36181", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36181" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36181" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36181. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.66" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36179-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36179", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36179" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36179" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36179. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.21" + }, + { + "name": "contrast:epssPercentile", + "value": "97.39" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-10650-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-10650", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10650" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10650" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-10650. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "87.77" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36185-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36185", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36185" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36185" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36185. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36188-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36188", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36188" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36188" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36188. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.56" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36187-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36187", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36187" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36187" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36187. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.9" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36189-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36189", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36189" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36189" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36189. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.5" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36183-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36183", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36183" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36183" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36183. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-20190-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2021-20190", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20190" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20190" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2021-20190. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "94.05" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-5968-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-5968", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5968" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5968" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-5968. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.72" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-24616-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-24616", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24616" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24616" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-24616. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "95.06" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-24750-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-24750", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24750" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24750" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-24750. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.95" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-42004-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2022-42004", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2022-42004. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "85.29" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-42003-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2022-42003", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2022-42003. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "85.29" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-25649-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-25649", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25649" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25649" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-25649. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.18" + }, + { + "name": "contrast:epssPercentile", + "value": "96.96" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-12023-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-12023", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12023" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12023" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-12023. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "94.88" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36518-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36518", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36518" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36518" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36518. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.43" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14439-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-14439", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14439" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14439" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-14439. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.54" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-12022-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-12022", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12022" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12022" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-12022. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.96" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12086-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-12086", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12086" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12086" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-12086. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.22" + }, + { + "name": "contrast:epssPercentile", + "value": "97.49" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 0.22, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12384-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-12384", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12384" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12384" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-12384. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.45" + }, + { + "name": "contrast:epssPercentile", + "value": "98.7" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity; duration-based acceptance is acceptable at this stakes level." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12814-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-12814", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12814" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12814" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-12814. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.56" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity; duration-based acceptance is reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-26119-3e752dae0006ad516bf6f4138316db7b262912d0", + "id": "CVE-2023-26119", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26119" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26119" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.", + "recommendation": "Upgrade htmlunit from 2.21 to 2.70.0 to remediate CVE-2023-26119.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 1295 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21", + "versions": [ + { + "version": "2.21", + "status": "affected" + }, + { + "version": "2.70.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "1295" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "83.68" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.70.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable with 0 of 1295 classes loaded is a structural fact, safe regardless of critical severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-5529-3e752dae0006ad516bf6f4138316db7b262912d0", + "id": "CVE-2020-5529", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5529" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5529" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.", + "recommendation": "Upgrade htmlunit from 2.21 to 2.70.0 to remediate CVE-2020-5529.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 1295 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21", + "versions": [ + { + "version": "2.21", + "status": "affected" + }, + { + "version": "2.70.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "1295" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.2" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.70.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability, safe to rely on." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-10683-5d3ccc056b6f056dbf0dddfdf43894b9065a8f94", + "id": "CVE-2020-10683", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10683" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10683" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.", + "recommendation": "Upgrade dom4j from 1.6.1 to 20040902.021138 to remediate CVE-2020-10683.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (1 of 190 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/dom4j/dom4j@1.6.1", + "versions": [ + { + "version": "1.6.1", + "status": "affected" + }, + { + "version": "20040902.021138", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "1" + }, + { + "name": "contrast:classCount", + "value": "190" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.91" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "20040902.021138" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity dom4j XXE CVE accepted on duration alone; only 1 of 190 classes loaded but that single class could be the vulnerable path." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1000632-5d3ccc056b6f056dbf0dddfdf43894b9065a8f94", + "id": "CVE-2018-1000632", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000632" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000632" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.", + "recommendation": "Upgrade dom4j from 1.6.1 to 20040902.021138 to remediate CVE-2018-1000632.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (1 of 190 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/dom4j/dom4j@1.6.1", + "versions": [ + { + "version": "1.6.1", + "status": "affected" + }, + { + "version": "20040902.021138", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "1" + }, + { + "name": "contrast:classCount", + "value": "190" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.35" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "20040902.021138" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification with minimal (1/190) class usage - worth confirming that one class isn\u0027t the vulnerable path." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-1471-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-1471", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "SnakeYaml\u0027s Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml\u0027s SafeConsturctor when parsing untrusted content to restrict deserialization.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-1471. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable (0 of 206 classes) is structural, safe despite critical severity/EPSS 1.0." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-25857-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-25857", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-25857. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "85.19" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-18640-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2017-18640", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18640" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18640" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2017-18640. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.27" + }, + { + "name": "contrast:epssPercentile", + "value": "97.88" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-38749-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-38749", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-38749. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "80.02" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, medium severity, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-41854-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-41854", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41854" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41854" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "description": "Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-41854. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "72.34" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, medium severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-38751-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-38751", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-38751. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "78.16" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, medium severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-38752-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-38752", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38752" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38752" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-38752. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "83.78" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, medium severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-38750-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-38750", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "description": "Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-38750. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.42" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, medium severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22965-005d6c554f34b20dffcbdfc7edf9b80956e2dace", + "id": "CVE-2022-22965", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.", + "recommendation": "Upgrade spring-boot-starter-web from 1.5.4.RELEASE to 2.5.12 to remediate CVE-2022-22965. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-web@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "2.5.12", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.95" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1273-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2018-1273", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1273" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1273" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data\u0027s projection-based request payload binding hat can lead to a remote code execution attack.", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2018-1273. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.97" + }, + { + "name": "contrast:epssPercentile", + "value": "99.89" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical, KEV-listed, EPSS 0.97 spring-data-commons RCE accepted purely on duration with the library substantially loaded (152/554 classes) - high priority for human review." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1274-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2018-1274", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1274" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1274" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2018-1274. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "78.7" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification on same actively-loaded library." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41716-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2026-41716", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41716" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41716" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring Data\u0027s internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.\n\nAffected versions:\nSpring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2026-41716. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "29.32" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity CVE accepted on duration alone, though EPSS is negligible." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41721-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2026-41721", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41721" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41721" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory.\n\nAffected versions:\nSpring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2026-41721. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "25.72" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41711-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2026-41711", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41711" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41711" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.\n\nAffected versions:\nSpring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2026-41711. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "22.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1259-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2018-1259", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1259" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1259" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data\u0027s projection-based request payload binding to access arbitrary files on the system.", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2018-1259. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.65" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown/no severity score, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-41853-4f97fcbc10fecf6f048c3b65683781d031b9155e", + "id": "CVE-2022-41853", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41853" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41853" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property \"hsqldb.method_class_names\" to classes which are allowed to be called. For example, System.setProperty(\"hsqldb.method_class_names\", \"abc\") or Java argument -Dhsqldb.method_class_names\u003d\"abc\" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.", + "recommendation": "Upgrade hsqldb from 2.3.5 to 2.7.1 to remediate CVE-2022-41853. Latest available release is 2.7.4.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (229 of 601 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.hsqldb/hsqldb@2.3.5", + "versions": [ + { + "version": "2.3.5", + "status": "affected" + }, + { + "version": "2.7.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "229" + }, + { + "name": "contrast:classCount", + "value": "601" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.51" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.7.4" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity hsqldb CVE accepted purely on duration, library substantially loaded (229/601 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-5929-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2017-5929", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5929" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5929" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2017-5929. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.06" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For logback-classic: critical severity, duration-only justification with library actively loaded (63/178 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-6378-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2023-6378", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6378" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6378" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "A serialization vulnerability in logback receiver component part of \nlogback version 1.4.11 allows an attacker to mount a Denial-Of-Service \nattack by sending poisoned data.\n\n", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2023-6378. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "57.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For logback-classic: high severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-42550-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2021-42550", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42550" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42550" + }, + "score": 6.6, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2021-42550. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "90.73" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-10532-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2026-10532", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10532" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10532" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.\n\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalation has been identified, this issue constitutes a bypass of the \nintended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.33 inclusive.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2026-10532. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "30.0" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown severity, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-1225-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2026-1225", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1225" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1225" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.\n\n\n\n\nThe instantiation of a potentially malicious Java class requires that said class is present on the user\u0027s class-path. In addition, the attacker must have write access to a \nconfiguration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2026-1225. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "4.55" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown severity, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-9828-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2026-9828", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9828" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9828" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate objects from\n classes in the java.lang and java.util packages that are not explicitly\n blocked.\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalation has been identified, this issue constitutes a bypass of the \nintended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.32 inclusive.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2026-9828. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "29.96" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown severity, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-11226-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2025-11226", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11226" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11226" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.\n\n\n\nA successful attack requires the presence of Janino library and Spring Framework to be present on the user\u0027s class path. In addition, the attacker must  have write access to a \nconfiguration file. Alternatively, the attacker could inject a malicious \nenvironment variable pointing to a malicious configuration file. In both \ncases, the attack requires existing privilege.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2025-11226. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "9.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown severity, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-12798-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2024-12798", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12798" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12798" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core\n upto and including version 1.5.12 in Java applications allows\n attacker to execute arbitrary code by compromising an existing\n logback configuration file or by injecting an environment variable\n before program execution.\n\n\n\n\n\nMalicious logback configuration files can allow the attacker to execute \narbitrary code using the JaninoEventEvaluator extension.\n\n\n\nA successful attack requires the user to have write access to a \nconfiguration file. Alternatively, the attacker could inject a malicious \nenvironment variable pointing to a malicious configuration file. In both \ncases, the attack requires existing privilege.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2024-12798. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "38.03" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown severity, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-12801-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2024-12801", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12801" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12801" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to \nforge requests by compromising logback configuration files in XML.\n\n\n\nThe attacks involves the modification of DOCTYPE declaration in  XML configuration files.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2024-12801. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "13.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown severity, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2016-1000027-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2016-1000027", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000027" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000027" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Pivotal Spring Framework 4.1.4 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2016-1000027. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.32" + }, + { + "name": "contrast:epssPercentile", + "value": "98.2" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity spring-web CVE, EPSS 0.32, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-22243-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2024-22243", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22243" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22243" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "description": "Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2024-22243. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.74" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-22262-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2024-22262", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22262" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22262" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "description": "Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259  and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.\n\n", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2024-22262. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "65.81" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-22259-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2024-22259", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22259" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22259" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "description": "Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.\n\n", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2024-22259. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "84.1" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11039-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2018-11039", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11039" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11039" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2018-11039. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "85.17" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38820-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2024-38820", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38820" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38820" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2024-38820. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "47.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For spring-context: medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38809-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2024-38809", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38809" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38809" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "description": "Applications that parse ETags from \"If-Match\" or \"If-None-Match\" request headers are vulnerable to DoS attack.\n\nUsers of affected versions should upgrade to the corresponding fixed version.\n\nUsers of older, unsupported versions could enforce a size limit on \"If-Match\" and \"If-None-Match\" headers, e.g. through a Filter.", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2024-38809. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "55.77" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22965-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2022-22965", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2022-22965. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.95" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41842-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41842", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41842" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41842" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41842. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "33.0" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38819-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2024-38819", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38819" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38819" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2024-38819. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.55" + }, + { + "name": "contrast:epssPercentile", + "value": "98.95" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 0.55, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41845-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41845", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41845" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41845" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41845. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "5.6" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41846-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41846", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41846" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41846" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS) vulnerability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41846. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "4.65" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41844-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41844", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41844" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41844" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "A Spring MVC or Spring WebFlux application which configures a mapping for \"/**\" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41844. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "4.07" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41841-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41841", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41841" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41841" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41841. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "26.61" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41843-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41843", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41843" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41843" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41843. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "29.85" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-22745-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-22745", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22745" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22745" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n * the application is using Spring MVC or Spring WebFlux\n * the application is serving static resources from the file system\n * the application is running on a Windows platform\n\n\nWhen all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-22745. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "26.86" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41853-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41853", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41853" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41853" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41853. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "8.22" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-22741-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-22741", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22741" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22741" + }, + "score": 3.1, + "severity": "low", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n * the application is using Spring MVC or Spring WebFlux\n * the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled\n * the application adds support for encoded resources resolution\n * the resource cache must be empty when the attacker has access to the application\n\n\nWhen all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-22741. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "14.42" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Low severity, duration-based acceptance is fine." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-5929-ccedfbacef4a6515d2983e3f89ed753d5d4fb665", + "id": "CVE-2017-5929", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5929" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5929" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.", + "recommendation": "Upgrade logback-classic from 1.1.11 to 1.4.12 to remediate CVE-2017-5929. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (63 of 178 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-classic@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.4.12", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "63" + }, + { + "name": "contrast:classCount", + "value": "178" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.06" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For logback-classic: critical severity, duration-only justification with library actively loaded (63/178 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-6378-ccedfbacef4a6515d2983e3f89ed753d5d4fb665", + "id": "CVE-2023-6378", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6378" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6378" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "A serialization vulnerability in logback receiver component part of \nlogback version 1.4.11 allows an attacker to mount a Denial-Of-Service \nattack by sending poisoned data.\n\n", + "recommendation": "Upgrade logback-classic from 1.1.11 to 1.4.12 to remediate CVE-2023-6378. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (63 of 178 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-classic@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.4.12", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "63" + }, + { + "name": "contrast:classCount", + "value": "178" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "57.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For logback-classic: high severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22965-daa5abf3779c8cad1a2910e1ea08e4272489d8ae", + "id": "CVE-2022-22965", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.", + "recommendation": "Upgrade spring-beans from 4.3.9.RELEASE to 5.2.22.RELEASE to remediate CVE-2022-22965. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (202 of 408 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.22.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "202" + }, + { + "name": "contrast:classCount", + "value": "408" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.95" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22970-daa5abf3779c8cad1a2910e1ea08e4272489d8ae", + "id": "CVE-2022-22970", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22970" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22970" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.", + "recommendation": "Upgrade spring-beans from 4.3.9.RELEASE to 5.2.22.RELEASE to remediate CVE-2022-22970. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (202 of 408 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.22.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "202" + }, + { + "name": "contrast:classCount", + "value": "408" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "78.96" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8014-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-8014", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8014" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8014" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable \u0027supportsCredentials\u0027 for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8014. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.22" + }, + { + "name": "contrast:epssPercentile", + "value": "97.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity tomcat-embed-core CVE, duration-only justification, library heavily loaded (387/1481 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-24813-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-24813", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Path Equivalence: \u0027file.Name\u0027 (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat\u0027s file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.98, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-24813. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.97" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical, KEV-listed, EPSS 1.0 Tomcat path equality RCE accepted purely on duration despite heavy library usage - top priority review." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43512-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-43512", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43512. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "66.95" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-1938-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2020-1938", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-1938. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.99" + }, + { + "name": "contrast:epssPercentile", + "value": "99.94" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical, KEV-listed (Ghostcat), EPSS 0.99, accepted purely on duration - top priority review." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-31651-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-31651", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31651" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31651" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible \nfor a specially crafted request to bypass some rewrite rules. If those \nrewrite rules effectively enforced security constraints, those \nconstraints could be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-31651. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.92" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-50379-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-50379", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50379" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50379" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-50379. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.44" + }, + { + "name": "contrast:epssPercentile", + "value": "98.67" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, EPSS 0.44, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43515-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-43515", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515" + }, + "score": 9.1, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43515. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "64.31" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0232-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-0232", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0232" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0232" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange\u0027s blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0232. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.95" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 1.0, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-12617-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2017-12617", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2017-12617. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.98" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, KEV-listed, EPSS 1.0, duration-only justification - top priority review." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0199-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-0199", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0199. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.73" + }, + { + "name": "contrast:epssPercentile", + "value": "99.41" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 0.73, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8034-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-8034", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8034" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8034" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8034. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.21" + }, + { + "name": "contrast:epssPercentile", + "value": "97.43" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-17563-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-17563", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17563" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17563" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-17563. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.49" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-46589-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-46589", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-46589. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "84.59" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-55752-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-55752", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Relative Path Traversal vulnerability in Apache Tomcat.\n\nThe fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-55752. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.67" + }, + { + "name": "contrast:epssPercentile", + "value": "99.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 0.67, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41284-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-41284", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-41284. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "55.38" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-10072-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-10072", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-10072. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.73" + }, + { + "name": "contrast:epssPercentile", + "value": "99.41" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 0.73, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43513-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-43513", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43513. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "38.72" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-25122-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-25122", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25122" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25122" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A\u0027s request.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-25122. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.18" + }, + { + "name": "contrast:epssPercentile", + "value": "96.99" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-34750-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-34750", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34750" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34750" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-34750. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.02" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-48988-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-48988", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-48988. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.57" + }, + { + "name": "contrast:epssPercentile", + "value": "99.0" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 0.57, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-49125-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-49125", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-49125. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "87.57" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-52434-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-52434", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\n\nThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 9.0.107, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-52434. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "78.35" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-42252-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2022-42252", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42252" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42252" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2022-42252. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "73.24" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-53506-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-53506", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-53506. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "79.28" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-52520-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-52520", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-52520. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "79.97" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-31650-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-31650", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31650" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31650" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-31650. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.6" + }, + { + "name": "contrast:epssPercentile", + "value": "99.07" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 0.6, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-24549-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-24549", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-24549. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.23" + }, + { + "name": "contrast:epssPercentile", + "value": "97.6" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 0.23, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-44487-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-44487", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-44487. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "100.0" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, KEV-listed (HTTP/2 Rapid Reset), EPSS 1.0, duration-only justification - priority review." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1336-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1336", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1336. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.21" + }, + { + "name": "contrast:epssPercentile", + "value": "97.34" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-46701-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-46701", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" + }, + "score": 7.3, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "description": "Improper Handling of Case Sensitivity vulnerability in Apache Tomcat\u0027s GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-46701. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "86.11" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12418-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-12418", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" + }, + "score": 7.0, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-12418. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "66.64" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-25329-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-25329", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" + }, + "score": 7.0, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-25329. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "95.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-9484-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2020-9484", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" + }, + "score": 7.0, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter\u003d\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-9484. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.57" + }, + { + "name": "contrast:epssPercentile", + "value": "98.99" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 0.57, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1305-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1305", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1305. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.14" + }, + { + "name": "contrast:epssPercentile", + "value": "96.38" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0221-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-0221", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0221. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.46" + }, + { + "name": "contrast:epssPercentile", + "value": "98.71" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-24122-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-24122", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-24122. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.23" + }, + { + "name": "contrast:epssPercentile", + "value": "97.58" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8037-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-8037", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8037. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.67" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1304-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1304", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1304. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.17" + }, + { + "name": "contrast:epssPercentile", + "value": "96.86" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-61795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-61795", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-61795. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "65.15" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-21733-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-21733", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-21733. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.14" + }, + { + "name": "contrast:epssPercentile", + "value": "96.34" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-42795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-42795", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could \ncause Tomcat to skip some parts of the recycling process leading to \ninformation leaking from the current request/response to the next.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-42795. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "80.95" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11784-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-11784", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" + }, + "score": 4.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "description": "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to \u0027/foo/\u0027 when the user requested \u0027/foo\u0027) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-11784. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.94" + }, + { + "name": "contrast:epssPercentile", + "value": "99.85" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity; despite unusually high EPSS (0.94), lower stakes than critical/high per policy, acceptable on duration." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-1000487-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2017-1000487", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2017-1000487. Latest available release is 3.6.1.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "versions": [ + { + "version": "3.0.8", + "status": "affected" + }, + { + "version": "4.0.3", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "102" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "93.28" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.0.3" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability, safe despite critical severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-67030-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2025-67030", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" + }, + "score": 8.8, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2025-67030. Latest available release is 3.6.1.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "versions": [ + { + "version": "3.0.8", + "status": "affected" + }, + { + "version": "4.0.3", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "102" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "49.29" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.0.3" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4244-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2022-4244", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4244. Latest available release is 3.6.1.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "versions": [ + { + "version": "3.0.8", + "status": "affected" + }, + { + "version": "4.0.3", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "102" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "69.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.0.3" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4245-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2022-4245", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" + }, + "score": 4.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --\u003e sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4245. Latest available release is 3.6.1.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "versions": [ + { + "version": "3.0.8", + "status": "affected" + }, + { + "version": "4.0.3", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "102" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "50.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.0.3" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20445-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-20445", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" + }, + "score": 9.1, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20445.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.13" + }, + { + "name": "contrast:epssPercentile", + "value": "96.17" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability, safe despite critical severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20444-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-20444", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" + }, + "score": 9.1, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\"", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20444.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "94.87" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37136-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-37136", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The Bzip2 decompression decoder function doesn\u0027t allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37136.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "92.72" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37137-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-37137", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The Snappy frame decoder function doesn\u0027t restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37137.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.5" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16869-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-16869", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-16869.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.6" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-43797-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-43797", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + } + ], + "description": "Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. Netty prior to version 4.1.7.1.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to \"sanitize\" header names before it forward these to another remote system when used as proxy. This remote system can\u0027t see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.7.1.Final to receive a patch.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-43797.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "84.8" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21409-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21409", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21409.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.54" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21295-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21295", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel\u0027s pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21295.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.19" + }, + { + "name": "contrast:epssPercentile", + "value": "97.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21290-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21290", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty\u0027s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method \"File.createTempFile\" on unix-like systems creates a random file, but, by default will create this file with the permissions \"-rw-r--r--\". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty\u0027s \"AbstractDiskHttpData\" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own \"java.io.tmpdir\" when you start the JVM or use \"DefaultHttpDataFactory.setBaseDir(...)\" to set the directory to something that is only readable by the current user.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21290.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "76.68" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2015-2156-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2015-2156", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2015-2156.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-2332-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2026-2332", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" + }, + "score": 9.1, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n * https://w4ke.info/2025/06/18/funky-chunks.html\n\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext\u003d\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2026-2332. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "68.57" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability, safe despite critical severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-11143-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2025-11143", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "description": "The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2025-11143. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "5.32" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-6763-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2024-6763", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC. Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2024-6763. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "59.31" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-40167-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2023-40167", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2023-40167. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "62.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-2047-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2022-2047", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" + }, + "score": 2.7, + "severity": "low", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2022-2047. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.39" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41901-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-41901", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" + }, + "score": 9.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-41901.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "versions": [ + { + "version": "3.0.6.RELEASE", + "status": "affected" + }, + { + "version": "3.1.3.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "367" + }, + { + "name": "contrast:classCount", + "value": "549" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "35.65" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.1.3.RELEASE" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity thymeleaf CVE, duration-only justification, library heavily loaded (367/549 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40477-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-40477", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" + }, + "score": 9.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40477.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "versions": [ + { + "version": "3.0.6.RELEASE", + "status": "affected" + }, + { + "version": "3.1.3.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "367" + }, + { + "name": "contrast:classCount", + "value": "549" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "55.73" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.1.3.RELEASE" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40478-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-40478", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" + }, + "score": 9.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40478.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "versions": [ + { + "version": "3.0.6.RELEASE", + "status": "affected" + }, + { + "version": "3.1.3.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "367" + }, + { + "name": "contrast:classCount", + "value": "549" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "56.16" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.1.3.RELEASE" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Critical severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-3258-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2018-3258", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" + }, + "score": 8.8, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2018-3258.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "versions": [ + { + "version": "5.1.42", + "status": "affected" + }, + { + "version": "8.0.33", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "4" + }, + { + "name": "contrast:classCount", + "value": "347" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.33" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity mysql-connector CVE, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-22102-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2023-22102", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" + }, + "score": 8.3, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2023-22102.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "versions": [ + { + "version": "5.1.42", + "status": "affected" + }, + { + "version": "8.0.33", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "4" + }, + { + "name": "contrast:classCount", + "value": "347" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "56.43" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.33" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-2692-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2019-2692", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" + }, + "score": 6.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2019-2692.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "versions": [ + { + "version": "5.1.42", + "status": "affected" + }, + { + "version": "8.0.33", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "4" + }, + { + "name": "contrast:classCount", + "value": "347" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "40.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.33" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-21363-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2022-21363", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2022-21363.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "versions": [ + { + "version": "5.1.42", + "status": "affected" + }, + { + "version": "8.0.33", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "4" + }, + { + "name": "contrast:classCount", + "value": "347" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "68.89" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.33" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown severity, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-22733-10f526d22f58a32a8c3af26ccb0a6f16f4649935", + "id": "CVE-2026-22733", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.", + "recommendation": "Upgrade spring-boot-starter-actuator from 1.5.4.RELEASE to 3.5.12 to remediate CVE-2026-22733. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.5.12", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "28.97" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable (0 of 0 classes), consistent with starter POM containing no code, safe despite high severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-27772-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2022-27772", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" + }, + "score": 7.8, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "** UNSUPPORTED WHEN ASSIGNED ** spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2022-27772. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.0.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "183" + }, + { + "name": "contrast:classCount", + "value": "458" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "46.27" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity spring-boot CVE, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-22235-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2025-22235", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" + }, + "score": 7.3, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "description": "EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.\n\nYour application may be affected by this if all the following conditions are met:\n\n * You use Spring Security\n * EndpointRequest.to() has been used in a Spring Security chain configuration\n * The endpoint which EndpointRequest references is disabled or not exposed via web\n * Your application handles requests to /null and this path needs protection\n\n\nYou are not affected if any of the following is true:\n\n * You don\u0027t use Spring Security\n * You don\u0027t use EndpointRequest.to()\n * The endpoint which EndpointRequest.to() refers to is enabled and is exposed\n * Your application does not handle requests to /null or this path does not need protection", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2025-22235. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.0.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "183" + }, + { + "name": "contrast:classCount", + "value": "458" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "34.63" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40973-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2026-40973", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" + }, + "score": 7.0, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2026-40973. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.0.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "183" + }, + { + "name": "contrast:classCount", + "value": "458" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "3.32" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1196-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2018-1196", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the \"run_user\" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the \"run_user\" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2018-1196. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.0.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "183" + }, + { + "name": "contrast:classCount", + "value": "458" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "66.4" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-28366-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", + "id": "CVE-2022-28366", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.", + "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-28366. Latest available release is 2.70.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", + "versions": [ + { + "version": "2.21", + "status": "affected" + }, + { + "version": "2.61.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "53" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "80.88" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.70.0" + }, + { + "name": "contrast:devStatus", + "value": "NO_SHIELD" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NO_SHIELD" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-29546-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", + "id": "CVE-2022-29546", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.", + "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-29546. Latest available release is 2.70.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", + "versions": [ + { + "version": "2.21", + "status": "affected" + }, + { + "version": "2.61.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "53" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.25" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.70.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-25647-c4ba5371a29ac9b2ad6129b1d39ea38750043eff", + "id": "CVE-2022-25647", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.", + "recommendation": "Upgrade gson from 2.8.0 to 2.8.9 to remediate CVE-2022-25647. Latest available release is 2.12.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (36 of 174 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.google.code.gson/gson@2.8.0", + "versions": [ + { + "version": "2.8.0", + "status": "affected" + }, + { + "version": "2.8.9", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "36" + }, + { + "name": "contrast:classCount", + "value": "174" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.12" + }, + { + "name": "contrast:epssPercentile", + "value": "95.89" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.13.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity gson CVE, duration-only justification with library actively loaded (36/174 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-36090-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-36090", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 zip package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-36090. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.13" + }, + { + "name": "contrast:epssPercentile", + "value": "96.04" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35516-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35516", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35516. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.12" + }, + { + "name": "contrast:epssPercentile", + "value": "95.91" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35517-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35517", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 tar package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35517. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35515-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35515", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35515. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.12" + }, + { + "name": "contrast:epssPercentile", + "value": "95.73" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-25710-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2024-25710", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.\n\nUsers are recommended to upgrade to version 1.26.0 which fixes the issue.\n\n", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2024-25710. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "36.91" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, medium severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11771-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2018-11771", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "description": "When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17\u0027s ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress\u0027 zip package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2018-11771. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.97" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, medium severity." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-34169-d55d3f02a56ec4c25695fe67e1334ff8c2ecea23", + "id": "CVE-2022-34169", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.", + "recommendation": "Upgrade xalan from 2.7.2 to 2.7.3 to remediate CVE-2022-34169.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (7 of 1501 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/xalan/xalan@2.7.2", + "versions": [ + { + "version": "2.7.2", + "status": "affected" + }, + { + "version": "2.7.3", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "7" + }, + { + "name": "contrast:classCount", + "value": "1501" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.81" + }, + { + "name": "contrast:epssPercentile", + "value": "99.6" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.7.3" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, EPSS 0.81 xalan CVE, duration-only justification despite very low class usage (7/1501) - worth confirming those 7 classes aren\u0027t the vulnerable path." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1272-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1272", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1272. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "86.79" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity spring-core CVE, duration-only justification, library heavily loaded (334/791 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-15756-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-15756", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-15756. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "94.98" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41848-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2026-41848", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2026-41848. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "24.07" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11040-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-11040", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the \"jsonp\" and \"callback\" JSONP parameters, enabling cross-domain requests.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-11040. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "87.45" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1257-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1257", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1257. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "87.42" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1271-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1271", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1271. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.35" + }, + { + "name": "contrast:epssPercentile", + "value": "98.3" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable despite elevated EPSS (0.35)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1199-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1199", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1199. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "85.69" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-22096-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2021-22096", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" + }, + "score": 4.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2021-22096. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "69.88" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41850-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41850", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41850. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "28.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity spring-expression CVE, duration-only justification, library heavily loaded (91/142 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41851-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41851", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41851. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "28.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41849-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41849", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41849. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "17.87" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity, duration-only justification." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20863-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2023-20863", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20863. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "63.96" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20861-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2023-20861", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20861. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "59.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22950-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2022-22950", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2022-22950. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.36" + }, + { + "name": "contrast:epssPercentile", + "value": "98.36" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable despite EPSS 0.36." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41852-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41852", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41852. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "7.34" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38808-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2024-38808", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" + }, + "score": 4.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "description": "In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.\n\nSpecifically, an application is vulnerable when the following is true:\n\n * The application evaluates user-supplied SpEL expressions.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2024-38808. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "44.84" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20883-5591fa7358d950f374532c7d92dccf113ebfa1bb", + "id": "CVE-2023-20883", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.", + "recommendation": "Upgrade spring-boot-autoconfigure from 1.5.4.RELEASE to 2.5.15 to remediate CVE-2023-20883. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (195 of 848 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "2.5.15", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "195" + }, + { + "name": "contrast:classCount", + "value": "848" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "57.6" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity spring-boot-autoconfigure CVE, duration-only justification, library well-loaded (195/848 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-23672-a92b066b0ea9ee1cb05b7d5e4bfed4ad8898f741", + "id": "CVE-2024-23672", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" + }, + "score": 6.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "description": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-websocket from 8.5.15 to 8.0.32 to remediate CVE-2024-23672. Latest available release is 10.1.4.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (25 of 168 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "8.0.32", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "25" + }, + { + "name": "contrast:classCount", + "value": "168" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "82.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-25638-7e1217f0df943561766b715ffb6cb1d270f3b715", + "id": "CVE-2020-25638", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" + }, + "score": 7.4, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.", + "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2020-25638. Latest available release is 5.4.33.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", + "versions": [ + { + "version": "5.0.4.Final", + "status": "affected" + }, + { + "version": "5.5.6", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "1563" + }, + { + "name": "contrast:classCount", + "value": "3787" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "86.13" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.2.5.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity hibernate-core CVE, duration-only justification, library heavily loaded (1563/3787 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14900-7e1217f0df943561766b715ffb6cb1d270f3b715", + "id": "CVE-2019-14900", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.", + "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2019-14900. Latest available release is 5.4.33.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", + "versions": [ + { + "version": "5.0.4.Final", + "status": "affected" + }, + { + "version": "5.5.6", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "1563" + }, + { + "name": "contrast:classCount", + "value": "3787" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "80.65" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.2.5.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-7536-0622a9bcef2eed6d41b5b8e0662c36212009e375", + "id": "CVE-2017-7536", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" + }, + "score": 7.0, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager\u0027s reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().", + "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2017-7536.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", + "versions": [ + { + "version": "5.3.5.Final", + "status": "affected" + }, + { + "version": "8.0.2.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "225" + }, + { + "name": "contrast:classCount", + "value": "459" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "39.71" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.2.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity hibernate-validator CVE, duration-only justification, library well-loaded (225/459 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-2976-6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9", + "id": "CVE-2023-2976", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" + }, + "score": 7.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "Use of Java\u0027s default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.\n\nEven though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.\n\n", + "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2023-2976.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.google.guava/guava@19.0", + "versions": [ + { + "version": "19.0", + "status": "affected" + }, + { + "version": "33.6.0-jre", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "5" + }, + { + "name": "contrast:classCount", + "value": "1717" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "15.93" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "33.6.0-jre" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "High severity guava CVE, duration-only justification, though usage is minimal (5/1717 classes)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-8908-6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9", + "id": "CVE-2020-8908", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8908" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8908" + }, + "score": 3.3, + "severity": "low", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.", + "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2020-8908.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.google.guava/guava@19.0", + "versions": [ + { + "version": "19.0", + "status": "affected" + }, + { + "version": "33.6.0-jre", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "5" + }, + { + "name": "contrast:classCount", + "value": "1717" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "59.29" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "33.6.0-jre" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Low severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2012-0881-9bb329db1cfc4e22462c9d6b43a8432f5850e92c", + "id": "CVE-2012-0881", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0881" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0881" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.", + "recommendation": "Upgrade xercesimpl from 2.11.0 to 2.12.2 to remediate CVE-2012-0881.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (115 of 952 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/xerces/xercesimpl@2.11.0", + "versions": [ + { + "version": "2.11.0", + "status": "affected" + }, + { + "version": "2.12.2", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "115" + }, + { + "name": "contrast:classCount", + "value": "952" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.17" + }, + { + "name": "contrast:epssPercentile", + "value": "96.85" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.12.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown severity, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2013-4002-9bb329db1cfc4e22462c9d6b43a8432f5850e92c", + "id": "CVE-2013-4002", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.", + "recommendation": "Upgrade xercesimpl from 2.11.0 to 2.12.2 to remediate CVE-2013-4002.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (115 of 952 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/xerces/xercesimpl@2.11.0", + "versions": [ + { + "version": "2.11.0", + "status": "affected" + }, + { + "version": "2.12.2", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "115" + }, + { + "name": "contrast:classCount", + "value": "952" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.25" + }, + { + "name": "contrast:epssPercentile", + "value": "97.74" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.12.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown severity, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-23437-9bb329db1cfc4e22462c9d6b43a8432f5850e92c", + "id": "CVE-2022-23437", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23437" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23437" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "description": "There\u0027s a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.", + "recommendation": "Upgrade xercesimpl from 2.11.0 to 2.12.2 to remediate CVE-2022-23437.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (115 of 952 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/xerces/xercesimpl@2.11.0", + "versions": [ + { + "version": "2.11.0", + "status": "affected" + }, + { + "version": "2.12.2", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "115" + }, + { + "name": "contrast:classCount", + "value": "952" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.12" + }, + { + "name": "contrast:epssPercentile", + "value": "95.74" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.12.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-14338-9bb329db1cfc4e22462c9d6b43a8432f5850e92c", + "id": "CVE-2020-14338", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14338" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14338" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "A flaw was found in Wildfly\u0027s implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the \"use-grammar-pool-only\" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.", + "recommendation": "Upgrade xercesimpl from 2.11.0 to 2.12.2 to remediate CVE-2020-14338.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (115 of 952 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/xerces/xercesimpl@2.11.0", + "versions": [ + { + "version": "2.11.0", + "status": "affected" + }, + { + "version": "2.12.2", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "115" + }, + { + "name": "contrast:classCount", + "value": "952" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "68.28" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.12.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-34055-6fed8833ba044e22a2924f8fe70db4f126be7489", + "id": "CVE-2023-34055", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34055" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34055" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n * the application uses Spring MVC or Spring WebFlux\n * org.springframework.boot:spring-boot-actuator is on the classpath\n\n\n\n", + "recommendation": "Upgrade spring-boot-actuator from 1.5.4.RELEASE to 2.7.18 to remediate CVE-2023-34055. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (161 of 435 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot-actuator@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "2.7.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "161" + }, + { + "name": "contrast:classCount", + "value": "435" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "66.57" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14042-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2018-14042", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2018-14042. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.84" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14040-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2018-14040", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2018-14040. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "90.13" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2016-10735-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2016-10735", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2016-10735. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.91" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-8331-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2019-8331", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2019-8331. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.16" + }, + { + "name": "contrast:epssPercentile", + "value": "96.75" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-20677-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2018-20677", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20677" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20677" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2018-20677. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.78" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-20676-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2018-20676", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20676" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20676" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2018-20676. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.37" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-15250-2973d150c0dc1fefe998f834810d68f278ea58ec", + "id": "CVE-2020-15250", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15250" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15250" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + } + ], + "description": "In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system\u0027s temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.", + "recommendation": "Upgrade junit from 4.12 to 4.13.2 to remediate CVE-2020-15250.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 286 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/junit/junit@4.12", + "versions": [ + { + "version": "4.12", + "status": "affected" + }, + { + "version": "4.13.2", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "286" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "75.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.13.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability (test-scope library)." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-48924-0ce1edb914c94ebc388f086c6827e8bdeec71ac2", + "id": "CVE-2025-48924", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "description": "Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.", + "recommendation": "Upgrade commons-lang from 2.6 to 20030203.000129 to remediate CVE-2025-48924.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 133 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/commons-lang/commons-lang@2.6", + "versions": [ + { + "version": "2.6", + "status": "affected" + }, + { + "version": "20030203.000129", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "133" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "81.86" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For commons-lang3: code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-48924-905075e6c80f206bbe6cf1e809d2caa69f420c76", + "id": "CVE-2025-48924", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "description": "Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.", + "recommendation": "Upgrade commons-lang3 from 3.1 to 3.20.0 to remediate CVE-2025-48924.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 152 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-lang3@3.1", + "versions": [ + { + "version": "3.1", + "status": "affected" + }, + { + "version": "3.20.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "152" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "81.86" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "3.20.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For commons-lang3: code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-3797-9f559debeb095fb0040102aef37e5fee2830a470", + "id": "CVE-2019-3797", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3797" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3797" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.", + "recommendation": "Upgrade spring-data-jpa from 1.11.4.RELEASE to 1.11.22.RELEASE to remediate CVE-2019-3797. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (62 of 169 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE", + "versions": [ + { + "version": "1.11.4.RELEASE", + "status": "affected" + }, + { + "version": "1.11.22.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "62" + }, + { + "name": "contrast:classCount", + "value": "169" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "63.01" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-3802-9f559debeb095fb0040102aef37e5fee2830a470", + "id": "CVE-2019-3802", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3802" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3802" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.", + "recommendation": "Upgrade spring-data-jpa from 1.11.4.RELEASE to 1.11.22.RELEASE to remediate CVE-2019-3802. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (62 of 169 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE", + "versions": [ + { + "version": "1.11.4.RELEASE", + "status": "affected" + }, + { + "version": "1.11.22.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "62" + }, + { + "name": "contrast:classCount", + "value": "169" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.27" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22968-a186823724f03b98becd5f93b1fa107fe6f7a7ff", + "id": "CVE-2022-22968", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22968" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22968" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.", + "recommendation": "Upgrade spring-context from 4.3.9.RELEASE to 6.1.20 to remediate CVE-2022-22968. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (306 of 768 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.20", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "306" + }, + { + "name": "contrast:classCount", + "value": "768" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "92.45" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38820-a186823724f03b98becd5f93b1fa107fe6f7a7ff", + "id": "CVE-2024-38820", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38820" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38820" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.", + "recommendation": "Upgrade spring-context from 4.3.9.RELEASE to 6.1.20 to remediate CVE-2024-38820. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (306 of 768 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.20", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "306" + }, + { + "name": "contrast:classCount", + "value": "768" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "47.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "For spring-context: medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-22233-a186823724f03b98becd5f93b1fa107fe6f7a7ff", + "id": "CVE-2025-22233", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22233" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22233" + }, + "score": 3.1, + "severity": "low", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.\n\nAffected Spring Products and Versions\n\nSpring Framework:\n * 6.2.0 - 6.2.6\n\n * 6.1.0 - 6.1.19\n\n * 6.0.0 - 6.0.27\n\n * 5.3.0 - 5.3.42\n * Older, unsupported versions are also affected\n\n\n\nMitigation\n\nUsers of affected versions should upgrade to the corresponding fixed version.\n\nAffected version(s)Fix Version Availability 6.2.x\n 6.2.7\nOSS6.1.x\n 6.1.20\nOSS6.0.x\n 6.0.28\n Commercial https://enterprise.spring.io/ 5.3.x\n 5.3.43\n Commercial https://enterprise.spring.io/ \nNo further mitigation steps are necessary.\n\n\nGenerally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation.\n\nFor setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields.\n\nCredit\n\nThis issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.", + "recommendation": "Upgrade spring-context from 4.3.9.RELEASE to 6.1.20 to remediate CVE-2025-22233. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (306 of 768 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.20", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "306" + }, + { + "name": "contrast:classCount", + "value": "768" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "33.85" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Low severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-13956-d1577ae15f01ef5438c5afc62162457c00a34713", + "id": "CVE-2020-13956", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13956" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13956" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.", + "recommendation": "Upgrade httpclient from 4.5.3 to 4.5.13 to remediate CVE-2020-13956. Latest available release is 4.5.14.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 466 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.3", + "versions": [ + { + "version": "4.5.3", + "status": "affected" + }, + { + "version": "4.5.13", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "466" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "94.92" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "4.5.14" + }, + { + "name": "contrast:devStatus", + "value": "" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-29425-b1b6ea3b7e4aa4f492509a4952029cd8e48019ad", + "id": "CVE-2021-29425", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29425" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29425" + }, + "score": 4.8, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "description": "In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like \"//../foo\", or \"\\\\..\\foo\", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus \"limited\" path traversal), if the calling code would use the result to construct a path value.", + "recommendation": "Upgrade commons-io from 2.4 to 2.14.0 to remediate CVE-2021-29425. Latest available release is 2.22.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 110 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/commons-io/commons-io@2.4", + "versions": [ + { + "version": "2.4", + "status": "affected" + }, + { + "version": "2.14.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "110" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.1" + }, + { + "name": "contrast:epssPercentile", + "value": "95.34" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.0" + }, + { + "name": "contrast:devStatus", + "value": "" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-47554-b1b6ea3b7e4aa4f492509a4952029cd8e48019ad", + "id": "CVE-2024-47554", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554" + }, + "score": 4.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "description": "Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue.", + "recommendation": "Upgrade commons-io from 2.4 to 2.14.0 to remediate CVE-2024-47554. Latest available release is 2.22.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 110 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/commons-io/commons-io@2.4", + "versions": [ + { + "version": "2.4", + "status": "affected" + }, + { + "version": "2.14.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "110" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.0" + }, + { + "name": "contrast:devStatus", + "value": "" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable, structural non-reachability." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-49128-d478fb6de45a7c3d2cad07c8ad70c7f0a797a020", + "id": "CVE-2025-49128", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49128" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49128" + }, + "score": 4.0, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "Jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core\u0027s `JsonLocation._appendSourceDesc` method allows up to 500 bytes of unintended memory content to be included in exception messages. When parsing JSON from a byte array with an offset and length, the exception message incorrectly reads from the beginning of the array instead of the logical payload start. This results in possible information disclosure in systems using pooled or reused buffers, like Netty or Vert.x. This issue was silently fixed in jackson-core version 2.13.0, released on September 30, 2021, via PR #652. All users should upgrade to version 2.13.0 or later. If upgrading is not immediately possible, applications can mitigate the issue by disabling exception message exposure to clients to avoid returning parsing exception messages in HTTP responses and/or disabling source inclusion in exceptions to prevent Jackson from embedding any source content in exception messages, avoiding leakage.", + "recommendation": "Upgrade jackson-core from 2.8.8 to 2.22.1 to remediate CVE-2025-49128.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (48 of 95 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.22.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "48" + }, + { + "name": "contrast:classCount", + "value": "95" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "29.58" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity, duration-based acceptance reasonable." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-52999-d478fb6de45a7c3d2cad07c8ad70c7f0a797a020", + "id": "CVE-2025-52999", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52999" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52999" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.", + "recommendation": "Upgrade jackson-core from 2.8.8 to 2.22.1 to remediate CVE-2025-52999.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (48 of 95 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.22.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "48" + }, + { + "name": "contrast:classCount", + "value": "95" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "49.36" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Unknown severity, low stakes." + } + ] + } + ] +} \ No newline at end of file From 5cfd1928c6cfad34d3eba8c87c11238a6503155e Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 17:56:34 -0400 Subject: [PATCH 04/16] Scope all samples to a single app per report type cbom/aibom/blueprint were previously whole-org; rescoped with --app so every sample now reflects a single-application run, consistent with vex (which was already scoped to SAML-PetClinic-Demo). Crypto usage, AI usage, and vulnerable libraries happen to show up in three disjoint sets of applications in this org, so no single app has non-empty data for all four generators - each sample uses whichever app actually has real data for its report type (documented in the README table): - cbom / blueprint -> Cargo-Crypto-contrast-cargo-cats-frontgateservice - aibom -> Robert-cargocats-aiservice - vex -> SAML-PetClinic-Demo (unchanged) --- README.md | 16 ++-- samples/sample-aibom-advisor.md | 45 ++------- samples/sample-aibom.json | 72 ++------------ samples/sample-blueprint.json | 164 ++++---------------------------- samples/sample-cbom-advisor.md | 127 ++++++++++--------------- samples/sample-cbom.json | 121 ++++++++++------------- 6 files changed, 140 insertions(+), 405 deletions(-) diff --git a/README.md b/README.md index d1c75a7..efdf37d 100644 --- a/README.md +++ b/README.md @@ -242,16 +242,16 @@ Two sample AI-BOM files are included to try it with: ## Sample Reports -`samples/` has one real, current output from each generator and its matching advisor report, all captured against a live org in a single run - useful as a reference for what each format actually looks like without running the tool yourself: +`samples/` has one real, current output from each generator and its matching advisor report - useful as a reference for what each format actually looks like without running the tool yourself: -| CycloneDX document | Advisor report | -|---|---| -| `sample-cbom.json` | `sample-cbom-advisor.md` | -| `sample-aibom.json` | `sample-aibom-advisor.md` | -| `sample-blueprint.json` | *(no advisor - see the Blueprint section above)* | -| `sample-vex.json` | `sample-vex-advisor.md` | +| CycloneDX document | Advisor report | Scoped to | +|---|---|---| +| `sample-cbom.json` | `sample-cbom-advisor.md` | `Cargo-Crypto-contrast-cargo-cats-frontgateservice` | +| `sample-aibom.json` | `sample-aibom-advisor.md` | `Robert-cargocats-aiservice` | +| `sample-blueprint.json` | *(no advisor - see the Blueprint section above)* | `Cargo-Crypto-contrast-cargo-cats-frontgateservice` | +| `sample-vex.json` | `sample-vex-advisor.md` | `SAML-PetClinic-Demo` | -`sample-vex.json` is scoped to one application (`SAML-PetClinic-Demo`, 235 statements) rather than the whole org - a full-org VEX run makes one CVE-issues API call per application and produces a much larger file, which isn't necessary to illustrate the format. +Each is scoped with `--app` to one application rather than the whole org (smaller, more readable files, and a full-org VEX run makes one CVE-issues API call per application). They're deliberately *not* all the same app - in this org, crypto usage, AI usage, and vulnerable libraries happen to show up in three disjoint sets of applications, so no single app would produce non-empty output for all four generators. Each sample uses whichever app actually has real data for that report type. ## Configuration Reference diff --git a/samples/sample-aibom-advisor.md b/samples/sample-aibom-advisor.md index 58b0989..7f3e77c 100644 --- a/samples/sample-aibom-advisor.md +++ b/samples/sample-aibom-advisor.md @@ -5,7 +5,7 @@ --- -**Client:** Contrast AI Usage Inventory +**Client:** Robert-cargocats-aiservice **Report Date:** September 2, 2026 **Assessment Type:** Runtime AI/LLM Usage Inventory & Governance Risk Assessment @@ -15,7 +15,7 @@ This report inventories every AI/LLM model and provider observed actually running in production across your applications - the model, provider, destination endpoint, and real call stack behind each usage, captured by Contrast Security's runtime instrumentation. -**2** application(s) use AI, calling **1** distinct model(s) across **1** provider(s), for **2** total usage instance(s). +**1** application(s) use AI, calling **1** distinct model(s) across **1** provider(s), for **1** total usage instance(s). > No applications were flagged CRITICAL or HIGH risk for their AI usage. @@ -24,19 +24,18 @@ This report inventories every AI/LLM model and provider observed actually runnin | Application | Risk Level | Models Used | |-------------|------------|--------------| | Robert-cargocats-aiservice | LOW | `smollm2:135m-tuned` | -| Robert-cargocats-reportservice | LOW | `smollm2:135m-tuned` | ### Models & Providers | Provider | Model | Host Category | Applications | Invocations | |----------|-------|----------------|---------------|-------------| -| openai | `smollm2:135m-tuned` | local | 2 | 2 | +| openai | `smollm2:135m-tuned` | local | 1 | 2 | - **1** model(s) self-hosted/local (no external data egress) | Risk Level | Applications | |------------|--------------| -| LOW | 2 | +| LOW | 1 | --- @@ -48,11 +47,11 @@ This report inventories every AI/LLM model and provider observed actually runnin **Language:** JAVA | **Posture Score:** 7.4 (HIGH) | **Open Issues:** 7 | **Connects To:** Robert-cargocats-frontgateservice -Robert-cargocats-aiservice is a Java Spring Boot backend that appears to expose AI/chat functionality to Robert-cargocats-frontgateservice, acting as an internal microservice that wraps LLM calls behind a REST API. Its name and connection graph suggest it's a dedicated AI service tier within a larger 'cargocats' application, sitting behind a gateway rather than facing the internet directly. +Robert-cargocats-aiservice is a Java Spring Boot microservice that appears to provide AI/chat functionality as a backend for the Robert-cargocats-frontgateservice gateway. It exposes an endpoint that accepts requests and forwards them to a language model via an OpenAI-compatible client, acting as an internal AI integration layer within the CargoCats application suite. -**Risk Rationale:** The model is a small, self-hosted model (smollm2:135m-tuned) served via a local Ollama instance (http://ollama:11434/v1), not an external cloud provider. Since the endpoint stays inside the environment, there's no data egress to a third party, which substantially lowers governance risk even though the endpoint is called through an OpenAI-compatible client. +**Risk Rationale:** The model (smollm2:135m-tuned) is served locally via Ollama at an internal hostname, so no data leaves the environment to a third-party provider. This is self-hosted inference reachable only from an internal gateway service, which limits data exposure risk even though the call path is a straightforward, unauthenticated-looking pass-through. -**Recommendation:** Confirm the ollama host is on an internal-only network with no external exposure, and add basic usage monitoring/logging on the /openai endpoint so that if this ever gets pointed at an external provider it's caught by governance review. +**Recommendation:** Confirm the /openai endpoint has appropriate authentication and input validation, and add monitoring/logging for prompt content to catch any sensitive data being passed through, since local hosting reduces but doesn't eliminate governance blind spots. #### AI Usage @@ -66,35 +65,7 @@ Robert-cargocats-aiservice is a Java Spring Boot backend that appears to expose | **Frequency (model-wide)** | Very Low (2 invocations across all apps using this model) | | **Reachability (this app)** | 1 code path(s) in this application | -**What it's doing:** AiController.openai receives the request and delegates to AiService.chat, which calls the OpenAI-compatible ChatCompletionService.create client against a local Ollama server. This produces a chat completion response for the front gateway service, likely generating a reply for an end-user or upstream request routed through the gateway. - ---- - -### Robert-cargocats-reportservice - -**Risk Level:** LOW - -**Language:** JAVA | **Posture Score:** 6.7 (MEDIUM) | **Open Issues:** 2 | **Connects To:** Robert-cargocats-frontgateservice - -Robert-cargocats-reportservice is a Java-based Tomcat servlet application that appears to generate logistics reports for the CargoCats system, connected to a front gateway service that likely routes client requests to it. Its servlet-based structure (InsightServlet, LogisticsInsightService) suggests it produces analytical or insight-driven reporting on logistics data rather than handling raw transactional traffic itself. - -**Risk Rationale:** The model is served via a local Ollama instance (http://ollama:11434/v1) using the OpenAI-compatible client, meaning no data leaves the internal network to a third-party provider. This is self-hosted inference, so there's no external data egress concern, though it's worth confirming the model and endpoint are intentionally deployed rather than a developer default left in place. - -**Recommendation:** Confirm that the Ollama deployment is an intentionally provisioned internal service (not a leftover dev/test container) and document it in the AI governance inventory. Add monitoring for prompt/response content if logistics data passed to LogisticsInsightService includes sensitive shipment, customer, or partner details. - -#### AI Usage - -| Attribute | Value | -|-----------|-------| -| **Model** | `smollm2:135m-tuned` | -| **Provider** | openai | -| **Endpoint** | `http://ollama:11434/v1` | -| **Host Category** | local | -| **Route** | unknown | -| **Frequency (model-wide)** | Very Low (2 invocations across all apps using this model) | -| **Reachability (this app)** | 1 code path(s) in this application | - -**What it's doing:** InsightServlet.doPost handles an incoming POST request and calls LogisticsInsightService.getInsight, which invokes the OpenAI-compatible ChatCompletionService.create client against a local Ollama endpoint. This generates an AI-derived insight or summary for logistics report data as part of the report service's POST endpoint. +**What it's doing:** AiController.openai handles an incoming request and delegates to AiService.chat, which calls the OpenAI-compatible ChatCompletionService.create client method against a local Ollama instance. This generates a chat completion response for the controller's endpoint, likely relaying a user or gateway-supplied prompt to the locally hosted model. --- diff --git a/samples/sample-aibom.json b/samples/sample-aibom.json index f3830ee..b9031ea 100644 --- a/samples/sample-aibom.json +++ b/samples/sample-aibom.json @@ -1,14 +1,14 @@ { "bomFormat": "CycloneDX", "specVersion": "1.6", - "serialNumber": "urn:uuid:05f38b34-af16-4e16-b8d8-9d826c828595", + "serialNumber": "urn:uuid:736dae4b-836e-4f0a-a706-3a5d9519923b", "version": 1, "metadata": { - "timestamp": "2026-09-02T21:36:18Z", + "timestamp": "2026-09-02T21:55:47Z", "component": { "type": "application", - "bom-ref": "contrast-ai-inventory", - "name": "Contrast AI Usage Inventory", + "bom-ref": "robert-cargocats-aiservice", + "name": "Robert-cargocats-aiservice", "version": "1.0" } }, @@ -25,7 +25,7 @@ }, { "name": "contrast:uniqueLocations", - "value": "2" + "value": "1" }, { "name": "contrast:provider", @@ -45,10 +45,6 @@ { "location": "com.openai.services.blocking.chat.ChatCompletionServiceImpl$WithRawResponseImpl.create(ChatCompletionServiceImpl.kt)", "additionalContext": "App: Robert-cargocats-aiservice Stack Trace: com.openai.services.blocking.chat.ChatCompletionServiceImpl$WithRawResponseImpl.create(ChatCompletionServiceImpl.kt) com.openai.services.blocking.chat.ChatCompletionServiceImpl.create(ChatCompletionServiceImpl.kt:63) com.openai.services.blocking.chat.ChatCompletionService.create(ChatCompletionService.kt:64) com.contrast.aiservice.AiService.chat(AiService.java:54) com.contrast.aiservice.AiController.openai(AiController.java:30) java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) java.base/java.lang.reflect.Method.invoke(Unknown Source) org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258) org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191) org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118) org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986) org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891) org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089) org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979) org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014) org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:903) jakarta.servlet.http.HttpServlet.service(HttpServlet.java:564) org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885) jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:195) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167) org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:483) org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:116) org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:732) org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344) org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:398) org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:903) org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1740) org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1189) org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:658) org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63) java.base/java.lang.Thread.run(Unknown Source)" - }, - { - "location": "com.openai.services.blocking.chat.ChatCompletionServiceImpl$WithRawResponseImpl.create(ChatCompletionServiceImpl.kt)", - "additionalContext": "App: Robert-cargocats-reportservice Stack Trace: com.openai.services.blocking.chat.ChatCompletionServiceImpl$WithRawResponseImpl.create(ChatCompletionServiceImpl.kt) com.openai.services.blocking.chat.ChatCompletionServiceImpl.create(ChatCompletionServiceImpl.kt:63) com.openai.services.blocking.chat.ChatCompletionService.create(ChatCompletionService.kt:64) com.contrast.reportservice.LogisticsInsightService.getInsight(LogisticsInsightService.java:62) com.contrast.reportservice.InsightServlet.doPost(InsightServlet.java:36) javax.servlet.http.HttpServlet.service(HttpServlet.java:555) javax.servlet.http.HttpServlet.service(HttpServlet.java:623) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:201) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:146) org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:57) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:170) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:146) org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166) org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:88) org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:534) org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:129) org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:86) org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:764) org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:71) org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:350) org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:407) org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:71) org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:1344) org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:2089) org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:74) org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:976) org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:494) org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:80) java.base/java.lang.Thread.run(Thread.java:840)" } ] } @@ -98,54 +94,7 @@ "value": "Robert-cargocats-frontgateservice" } ], - "description": "Robert-cargocats-aiservice is a Java Spring Boot backend that appears to expose AI/chat functionality to Robert-cargocats-frontgateservice, acting as an internal microservice that wraps LLM calls behind a REST API. Its name and connection graph suggest it\u0027s a dedicated AI service tier within a larger \u0027cargocats\u0027 application, sitting behind a gateway rather than facing the internet directly." - }, - { - "type": "application", - "bom-ref": "app-robert-cargocats-reportservice", - "name": "Robert-cargocats-reportservice", - "externalReferences": [ - { - "type": "runtime-analysis-report", - "url": "https://eval.contrastsecurity.com/Contrast/cs/index.html#/6a3073a5-5e68-40e5-9d7d-165340fff15a/explorer?detailsId\u003d-929795855\u0026applicationId\u003dd4b29958-8dca-4945-a9f7-bbae45e0f757", - "comment": "Contrast Application Explorer" - } - ], - "properties": [ - { - "name": "contrast:language", - "value": "JAVA" - }, - { - "name": "contrast:postureScore", - "value": "6.7" - }, - { - "name": "contrast:postureSeverity", - "value": "MEDIUM" - }, - { - "name": "contrast:criticality", - "value": "3" - }, - { - "name": "contrast:openIssuesTotal", - "value": "2" - }, - { - "name": "contrast:serverCount", - "value": "1" - }, - { - "name": "contrast:libraryCount", - "value": "31" - }, - { - "name": "contrast:connectedApplications", - "value": "Robert-cargocats-frontgateservice" - } - ], - "description": "Robert-cargocats-reportservice is a Java-based Tomcat servlet application that appears to generate logistics reports for the CargoCats system, connected to a front gateway service that likely routes client requests to it. Its servlet-based structure (InsightServlet, LogisticsInsightService) suggests it produces analytical or insight-driven reporting on logistics data rather than handling raw transactional traffic itself." + "description": "Robert-cargocats-aiservice is a Java Spring Boot microservice that appears to provide AI/chat functionality as a backend for the Robert-cargocats-frontgateservice gateway. It exposes an endpoint that accepts requests and forwards them to a language model via an OpenAI-compatible client, acting as an internal AI integration layer within the CargoCats application suite." } ], "dependencies": [ @@ -156,17 +105,10 @@ ] }, { - "ref": "app-robert-cargocats-reportservice", + "ref": "robert-cargocats-aiservice", "dependsOn": [ "ai-openai-smollm2-135m-tuned" ] - }, - { - "ref": "contrast-ai-inventory", - "dependsOn": [ - "app-robert-cargocats-aiservice", - "app-robert-cargocats-reportservice" - ] } ] } \ No newline at end of file diff --git a/samples/sample-blueprint.json b/samples/sample-blueprint.json index 349572a..f910cdb 100644 --- a/samples/sample-blueprint.json +++ b/samples/sample-blueprint.json @@ -2,97 +2,21 @@ "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", "specFormat": "CycloneDX", "specVersion": "2.0", - "serialNumber": "urn:uuid:4777c422-3d4b-435c-bd82-87be40d6604f", + "serialNumber": "urn:uuid:c0876091-e05b-4bfb-bea5-e76d5c88112b", "version": 1, "metadata": { - "timestamp": "2026-09-02T21:36:50.226Z" + "timestamp": "2026-09-02T21:56:06.331Z" }, "blueprints": [ { "bom-ref": "blueprint-1", - "name": "Contrast Architecture Blueprint", + "name": "Blueprint - Cargo-Crypto-contrast-cargo-cats-frontgateservice", "description": "Generated from Contrast runtime observability data: application architecture/connections (contrast-graph) and crypto/AI usage observations, mapped onto the CycloneDX behavior taxonomy. Does not include threats, controls, or risks - see TM-BOM.", "modelTypes": [ "architecture", "behavioral" ], "assets": [ - { - "bom-ref": "asset-app-robert-cargocats-aiservice", - "name": "Robert-cargocats-aiservice", - "type": "system", - "classification": { - "criticality": "moderate" - }, - "properties": [ - { - "name": "contrast:language", - "value": "JAVA" - }, - { - "name": "contrast:postureScore", - "value": "7.4" - }, - { - "name": "contrast:postureSeverity", - "value": "HIGH" - }, - { - "name": "contrast:openIssuesTotal", - "value": "7" - }, - { - "name": "contrast:serverCount", - "value": "1" - }, - { - "name": "contrast:libraryCount", - "value": "56" - } - ], - "zone": "zone-env-qa" - }, - { - "bom-ref": "asset-app-cargo-crypto-contrast-cargo-cats-dataservice", - "name": "Cargo-Crypto-contrast-cargo-cats-dataservice", - "type": "system", - "zone": "zone-env-development" - }, - { - "bom-ref": "asset-app-robert-cargocats-reportservice", - "name": "Robert-cargocats-reportservice", - "type": "system", - "classification": { - "criticality": "moderate" - }, - "properties": [ - { - "name": "contrast:language", - "value": "JAVA" - }, - { - "name": "contrast:postureScore", - "value": "6.7" - }, - { - "name": "contrast:postureSeverity", - "value": "MEDIUM" - }, - { - "name": "contrast:openIssuesTotal", - "value": "2" - }, - { - "name": "contrast:serverCount", - "value": "1" - }, - { - "name": "contrast:libraryCount", - "value": "31" - } - ], - "zone": "zone-env-qa" - }, { "bom-ref": "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice", "name": "Cargo-Crypto-contrast-cargo-cats-frontgateservice", @@ -110,50 +34,32 @@ "name": "Robert-cargocats-dataservice", "type": "system", "description": "Known only as an architecture-graph connection target; no application-level data available." + }, + { + "bom-ref": "asset-external-robert-cargocats-reportservice", + "name": "Robert-cargocats-reportservice", + "type": "system", + "description": "Known only as an architecture-graph connection target; no application-level data available." + }, + { + "bom-ref": "asset-external-robert-cargocats-aiservice", + "name": "Robert-cargocats-aiservice", + "type": "system", + "description": "Known only as an architecture-graph connection target; no application-level data available." } ], "zones": [ - { - "bom-ref": "zone-env-qa", - "name": "QA", - "type": "deployment" - }, { "bom-ref": "zone-env-development", "name": "DEVELOPMENT", "type": "deployment" } ], - "flows": [ - { - "bom-ref": "flow-1", - "name": "Robert-cargocats-reportservice \u003c-\u003e Robert-cargocats-frontgateservice", - "type": "data", - "source": "asset-app-robert-cargocats-reportservice", - "destination": "asset-external-robert-cargocats-frontgateservice", - "bidirectional": true - }, - { - "bom-ref": "flow-2", - "name": "Robert-cargocats-aiservice \u003c-\u003e Robert-cargocats-frontgateservice", - "type": "data", - "source": "asset-app-robert-cargocats-aiservice", - "destination": "asset-external-robert-cargocats-frontgateservice", - "bidirectional": true - } - ], + "flows": [], "behaviors": { "instances": [ { "bom-ref": "behavior-1", - "behavior": "ai:generative:processesPrompt", - "actors": [ - "asset-app-robert-cargocats-aiservice" - ], - "trigger": "unknown" - }, - { - "bom-ref": "behavior-2", "behavior": "security:cryptography:encryptsData", "actors": [ "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" @@ -161,15 +67,7 @@ "trigger": "unknown" }, { - "bom-ref": "behavior-3", - "behavior": "security:cryptography:hashesData", - "actors": [ - "asset-app-cargo-crypto-contrast-cargo-cats-dataservice" - ], - "trigger": "unknown" - }, - { - "bom-ref": "behavior-4", + "bom-ref": "behavior-2", "behavior": "security:cryptography:hashesData", "actors": [ "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" @@ -177,23 +75,7 @@ "trigger": "unknown" }, { - "bom-ref": "behavior-5", - "behavior": "ai:generative:processesPrompt", - "actors": [ - "asset-app-robert-cargocats-reportservice" - ], - "trigger": "unknown" - }, - { - "bom-ref": "behavior-6", - "behavior": "security:cryptography:encryptsData", - "actors": [ - "asset-app-cargo-crypto-contrast-cargo-cats-dataservice" - ], - "trigger": "unknown" - }, - { - "bom-ref": "behavior-7", + "bom-ref": "behavior-3", "behavior": "security:cryptography:hashesData", "actors": [ "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" @@ -201,20 +83,12 @@ "trigger": "unknown" }, { - "bom-ref": "behavior-8", + "bom-ref": "behavior-4", "behavior": "security:cryptography:hashesData", "actors": [ "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" ], "trigger": "unknown" - }, - { - "bom-ref": "behavior-9", - "behavior": "security:cryptography:hashesData", - "actors": [ - "asset-app-cargo-crypto-contrast-cargo-cats-dataservice" - ], - "trigger": "unknown" } ] } diff --git a/samples/sample-cbom-advisor.md b/samples/sample-cbom-advisor.md index 6ff0b93..afc0c81 100644 --- a/samples/sample-cbom-advisor.md +++ b/samples/sample-cbom-advisor.md @@ -5,7 +5,7 @@ --- -**Client:** Contrast Crypto Inventory +**Client:** Cargo-Crypto-contrast-cargo-cats-frontgateservice **Report Date:** September 2, 2026 **Assessment Type:** Runtime Cryptographic Analysis & Quantum Risk Assessment @@ -15,7 +15,7 @@ This assessment inventories every cryptographic algorithm actually observed running in production across your applications - algorithm strength, mode, invocation frequency, and the real call context behind each finding, captured by Contrast Security's runtime instrumentation rather than declared dependencies or static code scanning. -**2** application(s) use cryptography, calling **4** distinct algorithm(s), for **7** total findings analyzed. +**1** application(s) use cryptography, calling **4** distinct algorithm(s), for **4** total findings analyzed. > No algorithms were flagged as needing post-quantum remediation. @@ -23,31 +23,26 @@ This assessment inventories every cryptographic algorithm actually observed runn | Application | Algorithms Used | |-------------|------------------| -| Cargo-Crypto-contrast-cargo-cats-dataservice | `AES/GCM/NoPadding`, `MD5`, `SHA-256` | | Cargo-Crypto-contrast-cargo-cats-frontgateservice | `AES/GCM/NoPadding`, `MD5`, `SHA-1`, `SHA-256` | ### Algorithms | Algorithm | Risk Level | Applications | Invocations | |-----------|------------|---------------|-------------| -| `AES/GCM/NoPadding` | LOW | 2 | 124 | -| `MD5` | UNKNOWN | 2 | 5 | +| `AES/GCM/NoPadding` | LOW | 1 | 124 | +| `MD5` | NOT_QUANTUM_ISSUE | 1 | 5 | | `SHA-1` | NOT_QUANTUM_ISSUE | 1 | 1 | -| `SHA-256` | UNKNOWN | 2 | 868 | +| `SHA-256` | LOW | 1 | 868 | - **0** algorithm(s) need post-quantum remediation (CRITICAL/HIGH/MEDIUM) -- **1** algorithm(s) are quantum-safe as-is (LOW) -- **1** algorithm(s) have classical (non-quantum) weaknesses to address separately +- **2** algorithm(s) are quantum-safe as-is (LOW) +- **2** algorithm(s) have classical (non-quantum) weaknesses to address separately ### Application Context -**Cargo-Crypto-contrast-cargo-cats-dataservice** - -Based on its name, this is likely a data service component for an application called "Cargo Cats," probably handling data persistence or retrieval for that system. With no observed connections or third-party libraries, it may be a newly instrumented, isolated, or lightly-used service, so this description should be treated as a low-confidence guess rather than a confirmed architectural role. - **Cargo-Crypto-contrast-cargo-cats-frontgateservice** -Based on its name, this is most likely the front-facing API gateway for the "Cargo Cats" application suite, handling inbound traffic and routing requests toward backend services. Since no connected applications or third-party libraries were observed, its architecture graph data is likely incomplete or it operates in isolation from the instrumented environment. +Based on its name, this is likely the front gateway service for the "cargo cats" application, probably handling incoming requests and routing them to backend services within that system. It appears to be an isolated or minimally instrumented component, since no connected applications or third-party libraries were observed, which may reflect limited runtime visibility rather than an actual lack of dependencies. ### Quantum Risk Overview @@ -58,8 +53,7 @@ Based on its name, this is most likely the front-facing API gateway for the "Car | Source Type | Count | Remediation Approach | |-------------|-------|---------------------| -| 🏠 Custom Code | 5 | Direct code change by dev team | -| ❓ Unknown | 2 | Requires investigation | +| 🏠 Custom Code | 4 | Direct code change by dev team | --- @@ -67,130 +61,105 @@ Based on its name, this is most likely the front-facing API gateway for the "Car ### 🟢 Low Priority (Quantum-Safe) -#### [LOW] Finding 1: No action needed - SHA-256 usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice +#### [LOW] Finding 1: No action needed for SHA-256 usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice | Attribute | Value | |-----------|-------| | **Algorithm** | `SHA-256` | | **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | | **Code Source** | 🏠 Custom Code | -| **Source Package** | `Unknown - stack trace not provided, cannot determine exact origin package` | -| **Remediation Owner** | No remediation owner needed at this time | +| **Source Package** | `Unknown, no stack trace provided` | +| **Remediation Owner** | N/A, no action required | | **Frequency** | Low (868 invocations) | -| **Reachability** | 2 code path(s) invoke this algorithm | -| **Data Sensitivity** | Unknown, no stack trace or entry point provided to determine specific data being hashed | -| **Data Lifetime** | short-term | - -**Description:** Application computes SHA-256 hashes, likely for integrity checks, checksums, or similar purposes. - -**Quantum Threat Analysis:** SHA-256 is a symmetric hash function. Grover's algorithm only provides a quadratic speedup against hash functions, reducing SHA-256's effective security from 256 bits to roughly 128 bits, which remains well above the security margin considered safe against quantum attacks. This is not vulnerable to Shor's algorithm since it isn't asymmetric. - -**Recommendation:** No remediation required. SHA-256 is quantum-resistant at current NIST security levels and does not need replacement as part of post-quantum migration planning. - -**Remediation Plan:** -None required. If this hash is being used in a context involving digital signatures or key exchange elsewhere in the same code path, those adjacent mechanisms should be evaluated separately since they may carry quantum risk even though SHA-256 itself does not. - ---- - -#### [LOW] Finding 2: No action needed for AES-GCM usage in Cargo-Crypto-contrast-cargo-cats-dataservice - -| Attribute | Value | -|-----------|-------| -| **Algorithm** | `AES/GCM/NoPadding` | -| **Application** | Cargo-Crypto-contrast-cargo-cats-dataservice | -| **Code Source** | 🏠 Custom Code | -| **Source Package** | `Unable to determine, no stack trace provided` | -| **Remediation Owner** | N/A, no fix required for quantum resistance | -| **Frequency** | Low (124 invocations) | -| **Reachability** | 2 code path(s) invoke this algorithm | -| **Data Sensitivity** | Unknown, no stack trace or entry point provided to determine specific data type | -| **Data Lifetime** | unknown | +| **Reachability** | 1 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown, stack trace not provided, likely general data integrity or identifier hashing | +| **Data Lifetime** | unknown (insufficient stack trace detail to determine) | -**Description:** The application uses AES/GCM/NoPadding for authenticated symmetric encryption, likely protecting data at rest or in transit. +**Description:** Application computes SHA-256 hashes, likely for integrity checks, data fingerprinting, or similar purposes. -**Quantum Threat Analysis:** AES-GCM is a symmetric algorithm. Grover's Algorithm only reduces its effective security by half, so AES-256-GCM remains at 128-bit security post-quantum, still considered secure. If this is AES-128-GCM, it would drop to an effective 64-bit security level, which is a concern independent of quantum computing and should be reviewed for key size. +**Quantum Threat Analysis:** SHA-256 is a symmetric primitive. Grover's algorithm provides at most a quadratic speedup against hash preimage/collision resistance, reducing effective security from 256 bits to roughly 128 bits, which remains well above the threshold considered secure. SHA-256 is not vulnerable to Shor's algorithm since it is not based on integer factorization or discrete logarithm problems. -**Recommendation:** Confirm the key size in use. If AES-256, no action is needed for quantum resistance. If AES-128, plan to upgrade to AES-256 to maintain long-term security margins, though this is a classical strength issue, not a quantum-specific one. +**Recommendation:** No remediation needed for quantum resistance. SHA-256 remains quantum-safe at current and foreseeable quantum computing capabilities. Continue monitoring NIST guidance in case recommendations change. **Remediation Plan:** -No stack trace was provided in this instance, so the specific code location and key size could not be verified. Request the full stack trace and confirm the key length parameter passed to Cipher.getInstance or equivalent key generation call before closing this out. +None required. If this SHA-256 usage is paired with an asymmetric algorithm elsewhere in the same workflow (e.g., signing a hash with RSA/ECDSA), that paired asymmetric operation is the actual quantum risk and should be evaluated separately, not this hash function itself. --- -#### [LOW] Finding 3: No action needed: AES/GCM authenticated encryption in Cargo-Crypto-contrast-cargo-cats-frontgateservice +#### [LOW] Finding 2: No action needed for AES/GCM usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice | Attribute | Value | |-----------|-------| | **Algorithm** | `AES/GCM/NoPadding` | | **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | | **Code Source** | 🏠 Custom Code | -| **Source Package** | `Unknown, no stack trace provided` | -| **Remediation Owner** | No remediation owner needed for this algorithm itself | +| **Source Package** | `Unknown, no stack trace provided to identify the originating package or class` | +| **Remediation Owner** | No remediation required, application team should confirm key size during a routine review | | **Frequency** | Low (124 invocations) | -| **Reachability** | 2 code path(s) invoke this algorithm | -| **Data Sensitivity** | Unknown, no stack trace provided, but AES-GCM is typically used for data-at-rest or payload encryption | -| **Data Lifetime** | long-term | +| **Reachability** | 1 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown, no stack trace or entry point provided to identify what data is being encrypted | +| **Data Lifetime** | short-term | -**Description:** Application uses AES/GCM/NoPadding for authenticated symmetric encryption, likely protecting data at rest or in transit payloads. +**Description:** The application uses AES/GCM/NoPadding for authenticated symmetric encryption. -**Quantum Threat Analysis:** AES is a symmetric cipher, only vulnerable to Grover's algorithm, which merely halves effective key strength. AES-256/GCM remains secure against quantum attack. If the implementation uses AES-128, effective post-quantum strength drops to approximately 64 bits, which is a separate concern worth verifying. +**Quantum Threat Analysis:** AES is symmetric crypto, so it's only affected by Grover's algorithm, which halves effective key strength. AES/GCM at 256-bit keys remains secure at roughly AES-128 equivalent strength post-quantum. This is quantum-safe by design as long as a 256-bit key is used. -**Recommendation:** No replacement required for the AES/GCM algorithm itself. Confirm the actual key size in use, if this is AES-128, plan an upgrade to AES-256 to maintain adequate post-quantum security margin. Also verify the key exchange or key management mechanism that provisions this AES key, since that mechanism (if asymmetric) is the actual quantum risk, not the AES-GCM operation itself. +**Recommendation:** No replacement needed. Confirm the key size configured for this AES/GCM usage is 256-bit rather than 128-bit, since 128-bit keys drop to roughly 64-bit equivalent strength under Grover's algorithm, which is inadequate for long-term protection. **Remediation Plan:** -No stack trace or entry point was provided with this finding, so code source and key size could not be confirmed. Pull the actual observation details/stack trace from Contrast to identify the calling class and confirm key length. If key material is derived via RSA/ECDH key exchange upstream, that component should be evaluated separately for quantum risk under CRITICAL/HIGH criteria. +Verify the key generation code (e.g., KeyGenerator.getInstance("AES").init(256)) uses 256-bit keys. No stack trace was available for this instance, so the exact call site couldn't be confirmed. If this data has a long retention period, treat that as a separate finding requiring key-size verification, not a post-quantum migration issue. --- ### ⚪ Non-Quantum Issues -#### [NOT_QUANTUM_ISSUE] Finding 4: Replace SHA-1 in Cargo-Crypto-contrast-cargo-cats-frontgateservice +#### [NOT_QUANTUM_ISSUE] Finding 3: Replace SHA-1 in cargo-cats-frontgateservice (classical break, not quantum) | Attribute | Value | |-----------|-------| | **Algorithm** | `SHA-1` | | **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | | **Code Source** | 🏠 Custom Code | -| **Source Package** | `Unknown, stack trace not provided` | -| **Remediation Owner** | Application development team (pending stack trace confirmation) | +| **Source Package** | `Unknown, no stack trace provided in this observation` | +| **Remediation Owner** | Application development team for cargo-cats-frontgateservice | | **Frequency** | Very Low (1 invocations) | | **Reachability** | 1 code path(s) invoke this algorithm | -| **Data Sensitivity** | Unknown, no stack trace available to determine data type | +| **Data Sensitivity** | Unknown, no stack trace available to determine what data is being hashed | | **Data Lifetime** | short-term | -**Description:** Application computes a SHA-1 hash, purpose unclear due to missing stack trace and entry point data +**Description:** Application computes a SHA-1 hash, purpose unclear due to missing stack trace and entry point details -**Quantum Threat Analysis:** SHA-1 is not a quantum-specific concern. Grover's algorithm only reduces effective security by a square-root factor, and SHA-1's 160-bit output would still nominally hit 80-bit quantum resistance, but SHA-1 is already classically broken via collision attacks (e.g., SHAttered) and should be replaced regardless of quantum considerations. +**Quantum Threat Analysis:** SHA-1 is a symmetric/hash primitive. Grover's algorithm only provides a quadratic speedup against hash preimage attacks, so SHA-1's quantum-adjusted strength would still be roughly 80 bits if it were otherwise sound. The real problem is that SHA-1 is already classically broken via practical collision attacks (e.g., SHAttered), which have nothing to do with quantum computing. -**Recommendation:** Replace SHA-1 with SHA-256 or better for any security-relevant use (integrity checks, digital signatures, certificate fingerprints). If SHA-1 is used only for non-security purposes (e.g., cache keys, checksums for deduplication), it may be acceptable to leave in place, but this should be confirmed by reviewing the actual call site. +**Recommendation:** Treat this as a standard cryptographic hygiene finding, not a post-quantum migration item. Replace SHA-1 with SHA-256 or SHA-3-256 for any integrity, signature, or fingerprinting use. If SHA-1 is being used for password hashing, switch to a dedicated password hashing function such as bcrypt, scrypt, or Argon2 instead of a general-purpose hash. **Remediation Plan:** -No stack trace or entry point was provided for this finding, so the exact code location and purpose of the SHA-1 call could not be determined. Re-run the observation with full stack trace capture enabled to identify the source package and calling class before assigning remediation ownership. Once located, swap MessageDigest.getInstance("SHA-1") for "SHA-256" and verify no downstream systems depend on the specific 160-bit output length or format. +This finding is missing its stack trace and entry point, so the exact call site and use case (checksum, signature digest, password hash, cache key, etc.) can't be confirmed. Pull the full observation details from Contrast to identify the calling code before making changes, since the fix differs depending on whether SHA-1 is used for integrity checking versus password storage. --- -#### [NOT_QUANTUM_ISSUE] Finding 5: Replace MD5 hashing in Cargo-Crypto-contrast-cargo-cats-frontgateservice +#### [NOT_QUANTUM_ISSUE] Finding 4: Replace MD5 hashing in Cargo-Crypto-contrast-cargo-cats-frontgateservice | Attribute | Value | |-----------|-------| | **Algorithm** | `MD5` | | **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | | **Code Source** | 🏠 Custom Code | -| **Source Package** | `Unknown, no stack trace provided` | -| **Remediation Owner** | Application development team for Cargo-Crypto-contrast-cargo-cats-frontgateservice | +| **Source Package** | `Unknown - stack trace not provided in this observation` | +| **Remediation Owner** | Application development team (assumed custom_code based on naming; verify actual call site once stack trace is available) | | **Frequency** | Very Low (5 invocations) | -| **Reachability** | 2 code path(s) invoke this algorithm | -| **Data Sensitivity** | Unknown, no stack trace or entry point provided to determine what data is being hashed | +| **Reachability** | 1 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown - no stack trace context available to determine what data is being hashed | | **Data Lifetime** | unknown | -**Description:** Application computes MD5 hashes, likely for checksums, cache keys, or similar non-cryptographic purposes. +**Description:** Application uses MD5 hashing, observed 5 times, with no stack trace or entry point provided to determine the specific purpose. -**Quantum Threat Analysis:** MD5 is not a quantum vulnerability. It's classically broken due to well-known collision attacks (Grover's algorithm only affects hash preimage resistance by a square root factor, which is not the issue here). This is a legacy cryptographic weakness unrelated to post-quantum migration planning. +**Quantum Threat Analysis:** MD5 is classically broken (collision attacks are practical today) but this is not a quantum-specific vulnerability. Grover's algorithm would only provide a quadratic speedup against a preimage attack, and MD5 is already broken well beyond that by classical cryptanalysis. This should be tracked as a standard cryptographic weakness, not a post-quantum migration item. -**Recommendation:** Treat this as a classical crypto hygiene finding rather than a quantum migration item. If MD5 is used for any security purpose (integrity checks, password handling, digital signatures), replace it with SHA-256 or SHA-3. If it's used for non-security purposes (cache keys, checksums for non-adversarial data), it may be lower priority but should still be documented as a known weak algorithm. +**Recommendation:** Replace MD5 with SHA-256 or SHA-3 for any integrity, hashing, or fingerprinting use case. If MD5 is being used for password storage, replace it with a proper password hashing function (bcrypt, scrypt, or Argon2) instead. This is unrelated to quantum readiness and should be prioritized as a classical cryptographic hygiene fix. **Remediation Plan:** -No stack trace or entry point was provided in this observation, so the exact code location and usage context couldn't be determined. Recommend pulling the full stack trace from the CBOM evidence to confirm whether this is a security-relevant use case before prioritizing remediation. If used for signatures or authentication, escalate to CRITICAL under classical crypto risk, separate from this quantum-specific assessment. +No stack trace or entry point was provided with this finding, so the exact call site and purpose (integrity check, password hashing, cache key, deduplication, etc.) can't be confirmed. Recommend re-pulling observation details (GET /observations/{id}/details) to get the stack trace before assigning to a team, since the fix differs significantly if this turns out to be password storage versus a non-security checksum use. --- @@ -198,10 +167,10 @@ No stack trace or entry point was provided in this observation, so the exact cod | Algorithm | Quantum Risk | Remediation Timeline | |-----------|--------------|----------------------| +| `SHA-256` | 🟢 LOW | ✅ No action needed | | `AES/GCM/NoPadding` | 🟢 LOW | ✅ No action needed | | `SHA-1` | ⚪ NOT_QUANTUM_ISSUE | 🔧 Classical security fix | -| `SHA-256` | ❓ UNKNOWN | Review | -| `MD5` | ❓ UNKNOWN | Review | +| `MD5` | ⚪ NOT_QUANTUM_ISSUE | 🔧 Classical security fix | --- diff --git a/samples/sample-cbom.json b/samples/sample-cbom.json index 2211310..9af3908 100644 --- a/samples/sample-cbom.json +++ b/samples/sample-cbom.json @@ -1,20 +1,20 @@ { "bomFormat": "CycloneDX", "specVersion": "1.6", - "serialNumber": "urn:uuid:a49f9bc3-dafb-443e-a4d9-bbe6b14ccb42", + "serialNumber": "urn:uuid:9dbc0165-69f6-4e9f-a3a3-65d529d28dde", "version": 1, "metadata": { - "timestamp": "2026-09-02T21:34:18Z", + "timestamp": "2026-09-02T21:54:40Z", "component": { "type": "application", - "bom-ref": "contrast-crypto-inventory", - "name": "Contrast Crypto Inventory", + "bom-ref": "cargo-crypto-contrast-cargo-cats-frontgateservice", + "name": "Cargo-Crypto-contrast-cargo-cats-frontgateservice", "version": "1.0" }, "properties": [ { "name": "quantum:enhancedAt", - "value": "2026-09-02T17:36:13.710929" + "value": "2026-09-02T17:55:43.336882" }, { "name": "quantum:enhancedBy", @@ -42,15 +42,15 @@ }, { "name": "quantum:title", - "value": "Replace SHA-1 in Cargo-Crypto-contrast-cargo-cats-frontgateservice" + "value": "Replace SHA-1 in cargo-cats-frontgateservice (classical break, not quantum)" }, { "name": "quantum:usageSummary", - "value": "Application computes a SHA-1 hash, purpose unclear due to missing stack trace and entry point data" + "value": "Application computes a SHA-1 hash, purpose unclear due to missing stack trace and entry point details" }, { "name": "quantum:dataSensitivity", - "value": "Unknown, no stack trace available to determine data type" + "value": "Unknown, no stack trace available to determine what data is being hashed" }, { "name": "quantum:dataLifetime", @@ -62,23 +62,23 @@ }, { "name": "quantum:sourcePackage", - "value": "Unknown, stack trace not provided" + "value": "Unknown, no stack trace provided in this observation" }, { "name": "quantum:remediationOwner", - "value": "Application development team (pending stack trace confirmation)" + "value": "Application development team for cargo-cats-frontgateservice" }, { "name": "quantum:quantumThreat", - "value": "SHA-1 is not a quantum-specific concern. Grover\u0027s algorithm only reduces effective security by a square-root factor, and SHA-1\u0027s 160-bit output would still nominally hit 80-bit quantum resistance, but SHA-1 is already classically broken via collision attacks (e.g., SHAttered) and should be replaced regardless of quantum considerations." + "value": "SHA-1 is a symmetric/hash primitive. Grover\u0027s algorithm only provides a quadratic speedup against hash preimage attacks, so SHA-1\u0027s quantum-adjusted strength would still be roughly 80 bits if it were otherwise sound. The real problem is that SHA-1 is already classically broken via practical collision attacks (e.g., SHAttered), which have nothing to do with quantum computing." }, { "name": "quantum:recommendation", - "value": "Replace SHA-1 with SHA-256 or better for any security-relevant use (integrity checks, digital signatures, certificate fingerprints). If SHA-1 is used only for non-security purposes (e.g., cache keys, checksums for deduplication), it may be acceptable to leave in place, but this should be confirmed by reviewing the actual call site." + "value": "Treat this as a standard cryptographic hygiene finding, not a post-quantum migration item. Replace SHA-1 with SHA-256 or SHA-3-256 for any integrity, signature, or fingerprinting use. If SHA-1 is being used for password hashing, switch to a dedicated password hashing function such as bcrypt, scrypt, or Argon2 instead of a general-purpose hash." }, { "name": "quantum:migrationNotes", - "value": "No stack trace or entry point was provided for this finding, so the exact code location and purpose of the SHA-1 call could not be determined. Re-run the observation with full stack trace capture enabled to identify the source package and calling class before assigning remediation ownership. Once located, swap MessageDigest.getInstance(\"SHA-1\") for \"SHA-256\" and verify no downstream systems depend on the specific 160-bit output length or format." + "value": "This finding is missing its stack trace and entry point, so the exact call site and use case (checksum, signature digest, password hash, cache key, etc.) can\u0027t be confirmed. Pull the full observation details from Contrast to identify the calling code before making changes, since the fix differs depending on whether SHA-1 is used for integrity checking versus password storage." }, { "name": "quantum:findingsAnalyzed", @@ -117,7 +117,7 @@ }, { "name": "contrast:uniqueLocations", - "value": "2" + "value": "1" }, { "name": "quantum:riskLevel", @@ -125,19 +125,19 @@ }, { "name": "quantum:title", - "value": "No action needed - SHA-256 usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice" + "value": "No action needed for SHA-256 usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice" }, { "name": "quantum:usageSummary", - "value": "Application computes SHA-256 hashes, likely for integrity checks, checksums, or similar purposes." + "value": "Application computes SHA-256 hashes, likely for integrity checks, data fingerprinting, or similar purposes." }, { "name": "quantum:dataSensitivity", - "value": "Unknown, no stack trace or entry point provided to determine specific data being hashed" + "value": "Unknown, stack trace not provided, likely general data integrity or identifier hashing" }, { "name": "quantum:dataLifetime", - "value": "short-term" + "value": "unknown (insufficient stack trace detail to determine)" }, { "name": "quantum:codeSource", @@ -145,34 +145,31 @@ }, { "name": "quantum:sourcePackage", - "value": "Unknown - stack trace not provided, cannot determine exact origin package" + "value": "Unknown, no stack trace provided" }, { "name": "quantum:remediationOwner", - "value": "No remediation owner needed at this time" + "value": "N/A, no action required" }, { "name": "quantum:quantumThreat", - "value": "SHA-256 is a symmetric hash function. Grover\u0027s algorithm only provides a quadratic speedup against hash functions, reducing SHA-256\u0027s effective security from 256 bits to roughly 128 bits, which remains well above the security margin considered safe against quantum attacks. This is not vulnerable to Shor\u0027s algorithm since it isn\u0027t asymmetric." + "value": "SHA-256 is a symmetric primitive. Grover\u0027s algorithm provides at most a quadratic speedup against hash preimage/collision resistance, reducing effective security from 256 bits to roughly 128 bits, which remains well above the threshold considered secure. SHA-256 is not vulnerable to Shor\u0027s algorithm since it is not based on integer factorization or discrete logarithm problems." }, { "name": "quantum:recommendation", - "value": "No remediation required. SHA-256 is quantum-resistant at current NIST security levels and does not need replacement as part of post-quantum migration planning." + "value": "No remediation needed for quantum resistance. SHA-256 remains quantum-safe at current and foreseeable quantum computing capabilities. Continue monitoring NIST guidance in case recommendations change." }, { "name": "quantum:migrationNotes", - "value": "None required. If this hash is being used in a context involving digital signatures or key exchange elsewhere in the same code path, those adjacent mechanisms should be evaluated separately since they may carry quantum risk even though SHA-256 itself does not." + "value": "None required. If this SHA-256 usage is paired with an asymmetric algorithm elsewhere in the same workflow (e.g., signing a hash with RSA/ECDSA), that paired asymmetric operation is the actual quantum risk and should be evaluated separately, not this hash function itself." }, { "name": "quantum:findingsAnalyzed", - "value": "2" + "value": "1" } ], "evidence": { "occurrences": [ - { - "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-dataservice" - }, { "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" } @@ -203,7 +200,7 @@ }, { "name": "contrast:uniqueLocations", - "value": "2" + "value": "1" }, { "name": "quantum:riskLevel", @@ -215,11 +212,11 @@ }, { "name": "quantum:usageSummary", - "value": "Application computes MD5 hashes, likely for checksums, cache keys, or similar non-cryptographic purposes." + "value": "Application uses MD5 hashing, observed 5 times, with no stack trace or entry point provided to determine the specific purpose." }, { "name": "quantum:dataSensitivity", - "value": "Unknown, no stack trace or entry point provided to determine what data is being hashed" + "value": "Unknown - no stack trace context available to determine what data is being hashed" }, { "name": "quantum:dataLifetime", @@ -231,34 +228,31 @@ }, { "name": "quantum:sourcePackage", - "value": "Unknown, no stack trace provided" + "value": "Unknown - stack trace not provided in this observation" }, { "name": "quantum:remediationOwner", - "value": "Application development team for Cargo-Crypto-contrast-cargo-cats-frontgateservice" + "value": "Application development team (assumed custom_code based on naming; verify actual call site once stack trace is available)" }, { "name": "quantum:quantumThreat", - "value": "MD5 is not a quantum vulnerability. It\u0027s classically broken due to well-known collision attacks (Grover\u0027s algorithm only affects hash preimage resistance by a square root factor, which is not the issue here). This is a legacy cryptographic weakness unrelated to post-quantum migration planning." + "value": "MD5 is classically broken (collision attacks are practical today) but this is not a quantum-specific vulnerability. Grover\u0027s algorithm would only provide a quadratic speedup against a preimage attack, and MD5 is already broken well beyond that by classical cryptanalysis. This should be tracked as a standard cryptographic weakness, not a post-quantum migration item." }, { "name": "quantum:recommendation", - "value": "Treat this as a classical crypto hygiene finding rather than a quantum migration item. If MD5 is used for any security purpose (integrity checks, password handling, digital signatures), replace it with SHA-256 or SHA-3. If it\u0027s used for non-security purposes (cache keys, checksums for non-adversarial data), it may be lower priority but should still be documented as a known weak algorithm." + "value": "Replace MD5 with SHA-256 or SHA-3 for any integrity, hashing, or fingerprinting use case. If MD5 is being used for password storage, replace it with a proper password hashing function (bcrypt, scrypt, or Argon2) instead. This is unrelated to quantum readiness and should be prioritized as a classical cryptographic hygiene fix." }, { "name": "quantum:migrationNotes", - "value": "No stack trace or entry point was provided in this observation, so the exact code location and usage context couldn\u0027t be determined. Recommend pulling the full stack trace from the CBOM evidence to confirm whether this is a security-relevant use case before prioritizing remediation. If used for signatures or authentication, escalate to CRITICAL under classical crypto risk, separate from this quantum-specific assessment." + "value": "No stack trace or entry point was provided with this finding, so the exact call site and purpose (integrity check, password hashing, cache key, deduplication, etc.) can\u0027t be confirmed. Recommend re-pulling observation details (GET /observations/{id}/details) to get the stack trace before assigning to a team, since the fix differs significantly if this turns out to be password storage versus a non-security checksum use." }, { "name": "quantum:findingsAnalyzed", - "value": "2" + "value": "1" } ], "evidence": { "occurrences": [ - { - "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-dataservice" - }, { "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" } @@ -288,7 +282,7 @@ }, { "name": "contrast:uniqueLocations", - "value": "2" + "value": "1" }, { "name": "quantum:riskLevel", @@ -296,19 +290,19 @@ }, { "name": "quantum:title", - "value": "No action needed for AES-GCM usage in Cargo-Crypto-contrast-cargo-cats-dataservice" + "value": "No action needed for AES/GCM usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice" }, { "name": "quantum:usageSummary", - "value": "The application uses AES/GCM/NoPadding for authenticated symmetric encryption, likely protecting data at rest or in transit." + "value": "The application uses AES/GCM/NoPadding for authenticated symmetric encryption." }, { "name": "quantum:dataSensitivity", - "value": "Unknown, no stack trace or entry point provided to determine specific data type" + "value": "Unknown, no stack trace or entry point provided to identify what data is being encrypted" }, { "name": "quantum:dataLifetime", - "value": "unknown" + "value": "short-term" }, { "name": "quantum:codeSource", @@ -316,34 +310,31 @@ }, { "name": "quantum:sourcePackage", - "value": "Unable to determine, no stack trace provided" + "value": "Unknown, no stack trace provided to identify the originating package or class" }, { "name": "quantum:remediationOwner", - "value": "N/A, no fix required for quantum resistance" + "value": "No remediation required, application team should confirm key size during a routine review" }, { "name": "quantum:quantumThreat", - "value": "AES-GCM is a symmetric algorithm. Grover\u0027s Algorithm only reduces its effective security by half, so AES-256-GCM remains at 128-bit security post-quantum, still considered secure. If this is AES-128-GCM, it would drop to an effective 64-bit security level, which is a concern independent of quantum computing and should be reviewed for key size." + "value": "AES is symmetric crypto, so it\u0027s only affected by Grover\u0027s algorithm, which halves effective key strength. AES/GCM at 256-bit keys remains secure at roughly AES-128 equivalent strength post-quantum. This is quantum-safe by design as long as a 256-bit key is used." }, { "name": "quantum:recommendation", - "value": "Confirm the key size in use. If AES-256, no action is needed for quantum resistance. If AES-128, plan to upgrade to AES-256 to maintain long-term security margins, though this is a classical strength issue, not a quantum-specific one." + "value": "No replacement needed. Confirm the key size configured for this AES/GCM usage is 256-bit rather than 128-bit, since 128-bit keys drop to roughly 64-bit equivalent strength under Grover\u0027s algorithm, which is inadequate for long-term protection." }, { "name": "quantum:migrationNotes", - "value": "No stack trace was provided in this instance, so the specific code location and key size could not be verified. Request the full stack trace and confirm the key length parameter passed to Cipher.getInstance or equivalent key generation call before closing this out." + "value": "Verify the key generation code (e.g., KeyGenerator.getInstance(\"AES\").init(256)) uses 256-bit keys. No stack trace was available for this instance, so the exact call site couldn\u0027t be confirmed. If this data has a long retention period, treat that as a separate finding requiring key-size verification, not a post-quantum migration issue." }, { "name": "quantum:findingsAnalyzed", - "value": "2" + "value": "1" } ], "evidence": { "occurrences": [ - { - "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-dataservice" - }, { "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" } @@ -367,28 +358,14 @@ "oid": "2.16.840.1.101.3.4.1.6" } }, - { - "type": "application", - "bom-ref": "app-cargo-crypto-contrast-cargo-cats-dataservice", - "name": "Cargo-Crypto-contrast-cargo-cats-dataservice", - "description": "Based on its name, this is likely a data service component for an application called \"Cargo Cats,\" probably handling data persistence or retrieval for that system. With no observed connections or third-party libraries, it may be a newly instrumented, isolated, or lightly-used service, so this description should be treated as a low-confidence guess rather than a confirmed architectural role." - }, { "type": "application", "bom-ref": "app-cargo-crypto-contrast-cargo-cats-frontgateservice", "name": "Cargo-Crypto-contrast-cargo-cats-frontgateservice", - "description": "Based on its name, this is most likely the front-facing API gateway for the \"Cargo Cats\" application suite, handling inbound traffic and routing requests toward backend services. Since no connected applications or third-party libraries were observed, its architecture graph data is likely incomplete or it operates in isolation from the instrumented environment." + "description": "Based on its name, this is likely the front gateway service for the \"cargo cats\" application, probably handling incoming requests and routing them to backend services within that system. It appears to be an isolated or minimally instrumented component, since no connected applications or third-party libraries were observed, which may reflect limited runtime visibility rather than an actual lack of dependencies." } ], "dependencies": [ - { - "ref": "app-cargo-crypto-contrast-cargo-cats-dataservice", - "dependsOn": [ - "crypto-sha-256", - "crypto-md5", - "crypto-aes-gcm-nopadding" - ] - }, { "ref": "app-cargo-crypto-contrast-cargo-cats-frontgateservice", "dependsOn": [ @@ -399,10 +376,12 @@ ] }, { - "ref": "contrast-crypto-inventory", + "ref": "cargo-crypto-contrast-cargo-cats-frontgateservice", "dependsOn": [ - "app-cargo-crypto-contrast-cargo-cats-dataservice", - "app-cargo-crypto-contrast-cargo-cats-frontgateservice" + "crypto-sha-1", + "crypto-sha-256", + "crypto-md5", + "crypto-aes-gcm-nopadding" ] } ] From 33de63ce29df8130465bf421694e1d25da9c3e58 Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 18:13:57 -0400 Subject: [PATCH 05/16] Rework VEX Advisor report: merge duplicate CVE lists, summary-first layout The report previously listed every CVE twice - once in a per-CVE table (CVE/Library/Severity/State/Assessment), then again as an almost identical bullet list repeating the same CVEs with a one-line rationale. Merged into one table per app: needs_review rows carry their rationale inline, sound rows stay in a compact collapsible list without repeating rationale text (235 statements were making this report's "Application Review" section over 500 lines for one app). Report now opens with a Summary section before any per-app detail: what the report is, what it covers (app/statement counts), and computed Key Findings bullets - flagged-claim count, CISA KEV-listed CVEs among the flagged claims (deduplicated), high-EPSS (>=0.5) flagged claims, and which apps rated CRITICAL/HIGH. These are computed directly from the VEX's own contrast:cisaKev/epssScore properties, not AI-generated, so they stay auditable. Also fixed a related latent bug found while rewriting this: writeAssessmentsToVex appended contrast:vexAdvisorAssessment/Rationale properties without removing prior ones, so re-running vex-advisor on the same file accumulated duplicate properties per vulnerability. Verified idempotent now - a second run stays at 235 properties. Regenerated samples/sample-vex.json and sample-vex-advisor.md against SAML-PetClinic-Demo to reflect both fixes (report went from 533 to 311 lines with the same underlying data). --- samples/sample-vex-advisor.md | 744 ++++++------------ samples/sample-vex.json | 600 +++++++------- .../runtimeanalyst/VEXAdvisor.java | 142 +++- 3 files changed, 670 insertions(+), 816 deletions(-) diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index eec8145..42b87d8 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -10,513 +10,291 @@ --- -## Executive Summary +## Summary This report reviews VEX (Vulnerability Exploitability eXchange) claims generated from Contrast Security runtime library-usage and CVE Shield/Protect data. It does not re-derive whether a CVE exists - it judges whether each `not_affected`/`in_triage` claim is well-supported enough to rely on as-is, or whether a human should look at it first. -**1** application(s), **235** VEX statement(s) reviewed. +**Coverage:** 1 application(s), 235 VEX statement(s) reviewed. -> **124 claim(s) flagged for human review** before relying on them. +**Key Findings:** + +- **61 of 235 claim(s) flagged for human review** before relying on them. +- **8 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. +- **10 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+4 more). +- Application(s) rated CRITICAL/HIGH risk: SAML-PetClinic-Demo. ### Applications | Application | Risk Level | Statements | |-------------|------------|------------| -| SAML-PetClinic-Demo | CRITICAL | 235 | +| SAML-PetClinic-Demo | HIGH | 235 | | Risk Level | Applications | |------------|--------------| -| CRITICAL | 1 | +| HIGH | 1 | --- -## Application Review +## Application Detail ### SAML-PetClinic-Demo -**Risk Level:** CRITICAL +**Risk Level:** HIGH + +SAML-PetClinic-Demo carries roughly 210 VEX claims across ~40 outdated libraries (jackson-databind 2.8.8, tomcat-embed-core 8.5.15, spring-web/webmvc/beans 4.3.9, snakeyaml 1.17, netty 3.5.7, plexus-utils 3.0.8, etc.), almost all `not_affected`. A meaningful minority are backed by `code_not_reachable` (zero classes loaded) and are structurally sound; the majority instead rely on 288 days of non-execution as the sole justification, and a large number of those cover critical/high-severity or KEV-listed CVEs. + +**Risk Rationale:** The 288-day observation window comfortably clears the 30-day policy threshold, so duration alone isn't the problem. The problem is scale and severity: dozens of critical-severity jackson-databind CVEs, four instances of the KEV-listed Spring4Shell CVE-2022-22965 (three of which rely on duration-only reasoning rather than code_not_reachable), KEV-listed Tomcat Ghostcat/CVE-2020-1938, CVE-2017-12617, CVE-2025-24813, and CVE-2023-44487, plus KEV-listed spring-data-commons CVE-2018-1273 (EPSS 0.97) are all accepted purely on 'no observed execution' rather than structural non-reachability. Given the number and severity of these, this VEX set should not be trusted at face value for its critical/KEV entries. + +**Recommendation:** Prioritize human review of: all four spring-beans/spring-webmvc/spring-web instances tied to CVE-2022-22965 (data-binding RCE, KEV), spring-data-commons CVE-2018-1273 (KEV, EPSS 0.97), the KEV-listed tomcat-embed-core CVEs (CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487), and the ~24 critical-severity jackson-databind CVEs on 2.8.8. For these, verify with a manual reachability/pen-test check or accept the library upgrade instead of the VEX claim. The `code_not_reachable` claims (htmlunit, snakeyaml, netty, plexus-utils, jetty-http, bootstrap, junit, commons-lang/-lang3, commons-compress, neko-htmlunit, commons-io, httpclient, spring-boot-starter-web/-actuator) can be relied on as-is. -SAML-PetClinic-Demo has roughly 235 VEX claims spanning ~35 libraries, almost entirely 'not_affected' with either code_not_reachable (genuinely sound, ~90 claims) or 288-day duration-based absence-of-execution reasoning (~145 claims). The duration-based claims comfortably clear the 30-day policy threshold, but a large share of them cover critical/high severity CVEs -including six tied to CISA KEV entries (Spring4Shell CVE-2022-22965 x2 duration-based, Tomcat Ghostcat CVE-2020-1938, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487) - so the overall posture leans on probabilistic reasoning for its riskiest findings. +#### Needs Review (61) -**Risk Rationale:** Multiple actively-exploited (KEV) critical CVEs - notably CVE-2022-22965 (Spring4Shell) on spring-webmvc and spring-beans, and CVE-2020-1938/CVE-2025-24813/CVE-2017-12617/CVE-2023-44487 on tomcat-embed-core - are marked not_affected solely on 'no observed execution in 288 days,' not structural non-reachability, despite the libraries being substantially loaded (up to 387 of 1481 classes for tomcat, 166/498 for spring-webmvc). Dozens more critical/high jackson-databind, spring-core/web/expression, thymeleaf, and hsqldb CVEs follow the same pattern. These are exactly the claims the review criteria flag as weakest: severe, exploitable CVEs accepted on absence of evidence rather than proof of unreachability. +| CVE | Library | Severity | State | Rationale | +|-----|---------|----------|-------|-----------| +| CVE-2018-14721 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (10.0) accepted solely on 288 days of non-execution with no structural non-reachability; jackson-databind deserialization CVEs of this class are historically found reachable unexpectedly. | +| CVE-2018-11307 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted on duration alone; no code_not_reachable backing. | +| CVE-2017-17485 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) with elevated EPSS (0.5, 98.8th pct) accepted purely on non-execution duration; warrants a closer look. | +| CVE-2020-8840 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8), EPSS 0.27, duration-only justification - worth a manual check. | +| CVE-2019-16335 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2019-20330 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2018-14718 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2018-14720 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2018-14719 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2020-9548 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2019-14540 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2020-9547 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2019-14892 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2019-16942 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2018-19361 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2019-16943 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2018-19360 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2018-19362 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2019-17267 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2017-7525 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8), EPSS 0.38, duration-only - the well-known jackson polymorphic-deserialization gadget class, worth verifying. | +| CVE-2018-7489 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8), EPSS 0.2, accepted solely on non-execution duration. | +| CVE-2019-17531 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2017-15095 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2019-14379 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | +| CVE-2020-36179 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | High severity with EPSS 0.21 (97th pct) accepted on duration alone; worth a closer look. | +| CVE-2020-25649 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | High severity with EPSS 0.18 (97th pct) accepted purely on duration; worth verifying. | +| CVE-2019-12086 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | High severity with EPSS 0.22 (97th pct) accepted purely on non-execution duration; worth verifying. | +| CVE-2020-10683 | `pkg:maven/dom4j/dom4j@1.6.1` | critical | not_affected | Critical (9.8) dom4j XXE, only 1 of 190 classes ever used, but that one class is loaded and the claim relies purely on non-execution duration - worth confirming that class isn't the vulnerable entry point. | +| CVE-2022-22965 | `pkg:maven/org.springframework.boot/spring-boot-starter-web@1.5.4.RELEASE` | critical | not_affected | KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review. | +| CVE-2018-1273 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | critical | not_affected | KEV-listed, critical (9.8), EPSS 0.97 (99.9th pct) - one of the most exploitable CVEs in this VEX set, yet accepted purely on non-execution duration. Requires explicit human verification, not automated acceptance. | +| CVE-2022-41853 | `pkg:maven/org.hsqldb/hsqldb@2.3.5` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration despite substantial hsqldb usage (229/601 classes) - worth confirming. | +| CVE-2017-5929 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | critical | not_affected | Critical (9.8) on logback-classic, same underlying gap as the logback-core instance: accepted purely on non-execution duration. | +| CVE-2016-1000027 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | critical | not_affected | Critical (9.8) spring-web deserialization CVE accepted solely on non-execution duration despite meaningful library usage (211/559 classes); worth verifying. | +| CVE-2022-22965 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | critical | not_affected | KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review. | +| CVE-2024-38819 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | high | not_affected | High severity with elevated EPSS (0.55, 99th pct) accepted purely on non-execution duration; worth verifying. | +| CVE-2017-5929 | `pkg:maven/ch.qos.logback/logback-classic@1.1.11` | critical | not_affected | Critical (9.8) on logback-classic, same underlying gap as the logback-core instance: accepted purely on non-execution duration. | +| CVE-2022-22965 | `pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE` | critical | not_affected | KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review. | +| CVE-2018-8014 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | Critical (9.8) on heavily-used tomcat-embed-core (387/1481 classes), accepted purely on non-execution duration. | +| CVE-2025-24813 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | KEV-listed, critical (9.8), EPSS 1.0 - among the most exploitable CVEs in this set, accepted purely on duration; requires human verification. | +| CVE-2026-43512 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | Critical (9.8) accepted purely on non-execution duration on a heavily-loaded library. | +| CVE-2020-1938 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | KEV-listed (Ghostcat), critical (9.8), EPSS 0.99 - requires human verification rather than duration-only acceptance. | +| CVE-2025-31651 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | Critical (9.8) accepted purely on non-execution duration. | +| CVE-2024-50379 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | Critical (9.8), EPSS 0.44, accepted purely on non-execution duration. | +| CVE-2026-43515 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | Critical (9.1) accepted purely on non-execution duration. | +| CVE-2019-0232 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity with EPSS 1.0 (near-certain exploitation observed elsewhere) accepted purely on non-execution duration. | +| CVE-2017-12617 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | KEV-listed, EPSS 1.0 - requires human verification rather than duration-only acceptance. | +| CVE-2019-0199 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.73, accepted purely on non-execution duration. | +| CVE-2018-8034 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.21, accepted purely on non-execution duration. | +| CVE-2025-55752 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.67, accepted purely on non-execution duration. | +| CVE-2019-10072 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.73, accepted purely on non-execution duration. | +| CVE-2021-25122 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.18, accepted purely on non-execution duration. | +| CVE-2025-48988 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.57, accepted purely on non-execution duration. | +| CVE-2025-31650 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.6, accepted purely on non-execution duration. | +| CVE-2024-24549 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.23, accepted purely on non-execution duration. | +| CVE-2023-44487 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | KEV-listed (HTTP/2 Rapid Reset), EPSS 1.0 - requires human verification rather than duration-only acceptance. | +| CVE-2018-1336 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.21, accepted purely on non-execution duration. | +| CVE-2020-9484 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.57, accepted purely on non-execution duration. | +| CVE-2026-41901 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | Critical (9.0) thymeleaf CVE accepted solely on non-execution duration despite substantial library usage (367/549 classes); worth verifying. | +| CVE-2026-40477 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | Critical (9.0) accepted solely on non-execution duration. | +| CVE-2026-40478 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | Critical (9.0) accepted solely on non-execution duration. | +| CVE-2022-34169 | `pkg:maven/xalan/xalan@2.7.2` | high | not_affected | High severity with very high EPSS (0.81, 99.6th pct) accepted purely on non-execution duration despite the library being loaded (7/1501 classes) - worth verifying given the strong exploitability signal. | -**Recommendation:** Prioritize human review of the KEV-tagged claims first (CVE-2022-22965 on spring-webmvc/spring-beans, CVE-2020-1938, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487 on tomcat-embed-core, CVE-2018-1273 on spring-data-commons), then work through the remaining critical/high duration-only claims on jackson-databind, thymeleaf, spring-core/web/expression, hsqldb, dom4j, and mysql-connector-java. code_not_reachable claims (snakeyaml, netty, jetty-http, htmlunit, plexus-utils, commons-compress, bootstrap, junit, commons-lang/commons-lang3, commons-io, httpclient) can be trusted as-is; medium/low severity duration-based claims are acceptable without further review. +#### Sound (174) -#### VEX Statements +
174 claim(s) assessed as sound as-is - expand for the full list -| CVE | Library | Severity | State | Assessment | -|-----|---------|----------|-------|------------| -| CVE-2018-14721 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2018-11307 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2017-17485 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2020-8840 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2019-16335 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2019-20330 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2018-14718 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2018-14720 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2018-14719 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2020-9548 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2019-14540 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2020-9547 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2019-14892 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2019-16942 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2018-19361 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2019-16943 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2018-19360 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2018-19362 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2019-17267 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2017-7525 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2018-7489 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2019-17531 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2017-15095 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2019-14379 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | needs_review | -| CVE-2020-10673 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-35728 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-35491 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-35490 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36184 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36182 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36180 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36186 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36181 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36179 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-10650 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36185 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36188 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36187 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36189 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36183 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2021-20190 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2018-5968 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-24616 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-24750 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2022-42004 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2022-42003 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-25649 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2018-12023 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2020-36518 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2019-14439 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2018-12022 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2019-12086 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | needs_review | -| CVE-2019-12384 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | medium | not_affected | sound | -| CVE-2019-12814 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | medium | not_affected | sound | -| CVE-2023-26119 | `pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21` | critical | not_affected | sound | -| CVE-2020-5529 | `pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21` | high | not_affected | sound | -| CVE-2020-10683 | `pkg:maven/dom4j/dom4j@1.6.1` | critical | not_affected | needs_review | -| CVE-2018-1000632 | `pkg:maven/dom4j/dom4j@1.6.1` | high | not_affected | needs_review | -| CVE-2022-1471 | `pkg:maven/org.yaml/snakeyaml@1.17` | critical | not_affected | sound | -| CVE-2022-25857 | `pkg:maven/org.yaml/snakeyaml@1.17` | high | not_affected | sound | -| CVE-2017-18640 | `pkg:maven/org.yaml/snakeyaml@1.17` | high | not_affected | sound | -| CVE-2022-38749 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | sound | -| CVE-2022-41854 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | sound | -| CVE-2022-38751 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | sound | -| CVE-2022-38752 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | sound | -| CVE-2022-38750 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | sound | -| CVE-2022-22965 | `pkg:maven/org.springframework.boot/spring-boot-starter-web@1.5.4.RELEASE` | critical | not_affected | needs_review | -| CVE-2018-1273 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | critical | not_affected | needs_review | -| CVE-2018-1274 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | high | not_affected | needs_review | -| CVE-2026-41716 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | high | not_affected | needs_review | -| CVE-2026-41721 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | medium | not_affected | sound | -| CVE-2026-41711 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | medium | not_affected | sound | -| CVE-2018-1259 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | unknown | not_affected | sound | -| CVE-2022-41853 | `pkg:maven/org.hsqldb/hsqldb@2.3.5` | critical | not_affected | needs_review | -| CVE-2017-5929 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | critical | not_affected | needs_review | -| CVE-2023-6378 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | high | not_affected | needs_review | -| CVE-2021-42550 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | medium | not_affected | sound | -| CVE-2026-10532 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | -| CVE-2026-1225 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | -| CVE-2026-9828 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | -| CVE-2025-11226 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | -| CVE-2024-12798 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | -| CVE-2024-12801 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | sound | -| CVE-2016-1000027 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | critical | not_affected | needs_review | -| CVE-2024-22243 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2024-22262 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2024-22259 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2018-11039 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2024-38820 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2024-38809 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2022-22965 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | critical | not_affected | needs_review | -| CVE-2026-41842 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2024-38819 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2026-41845 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2026-41846 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2026-41844 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2026-41841 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2026-41843 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2026-22745 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2026-41853 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2026-22741 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | low | not_affected | sound | -| CVE-2017-5929 | `pkg:maven/ch.qos.logback/logback-classic@1.1.11` | critical | not_affected | needs_review | -| CVE-2023-6378 | `pkg:maven/ch.qos.logback/logback-classic@1.1.11` | high | not_affected | needs_review | -| CVE-2022-22965 | `pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE` | critical | not_affected | needs_review | -| CVE-2022-22970 | `pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2018-8014 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | -| CVE-2025-24813 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | -| CVE-2026-43512 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | -| CVE-2020-1938 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | -| CVE-2025-31651 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | -| CVE-2024-50379 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | -| CVE-2026-43515 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | needs_review | -| CVE-2019-0232 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2017-12617 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2019-0199 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2018-8034 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2019-17563 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2023-46589 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2025-55752 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2026-41284 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2019-10072 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2026-43513 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2021-25122 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2024-34750 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2025-48988 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2025-49125 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2025-52434 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2022-42252 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2025-53506 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2025-52520 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2025-31650 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2024-24549 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2023-44487 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2018-1336 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2025-46701 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2019-12418 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2021-25329 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2020-9484 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | needs_review | -| CVE-2018-1305 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | -| CVE-2019-0221 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | -| CVE-2021-24122 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | -| CVE-2018-8037 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | -| CVE-2018-1304 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | -| CVE-2025-61795 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | -| CVE-2024-21733 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | -| CVE-2023-42795 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | -| CVE-2018-11784 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | sound | -| CVE-2017-1000487 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | critical | not_affected | sound | -| CVE-2025-67030 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | high | not_affected | sound | -| CVE-2022-4244 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | high | not_affected | sound | -| CVE-2022-4245 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | medium | not_affected | sound | -| CVE-2019-20445 | `pkg:maven/io.netty/netty@3.5.7.Final` | critical | not_affected | sound | -| CVE-2019-20444 | `pkg:maven/io.netty/netty@3.5.7.Final` | critical | not_affected | sound | -| CVE-2021-37136 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | sound | -| CVE-2021-37137 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | sound | -| CVE-2019-16869 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | sound | -| CVE-2021-43797 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | sound | -| CVE-2021-21409 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | sound | -| CVE-2021-21295 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | sound | -| CVE-2021-21290 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | sound | -| CVE-2015-2156 | `pkg:maven/io.netty/netty@3.5.7.Final` | unknown | not_affected | sound | -| CVE-2026-2332 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | critical | not_affected | sound | -| CVE-2025-11143 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | sound | -| CVE-2024-6763 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | sound | -| CVE-2023-40167 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | sound | -| CVE-2022-2047 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | low | not_affected | sound | -| CVE-2026-41901 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | needs_review | -| CVE-2026-40477 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | needs_review | -| CVE-2026-40478 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | needs_review | -| CVE-2018-3258 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | high | not_affected | needs_review | -| CVE-2023-22102 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | high | not_affected | needs_review | -| CVE-2019-2692 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | medium | not_affected | sound | -| CVE-2022-21363 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | unknown | not_affected | sound | -| CVE-2026-22733 | `pkg:maven/org.springframework.boot/spring-boot-starter-actuator@1.5.4.RELEASE` | high | not_affected | sound | -| CVE-2022-27772 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | needs_review | -| CVE-2025-22235 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | needs_review | -| CVE-2026-40973 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | needs_review | -| CVE-2018-1196 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | medium | not_affected | sound | -| CVE-2022-28366 | `pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21` | high | not_affected | sound | -| CVE-2022-29546 | `pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21` | high | not_affected | sound | -| CVE-2022-25647 | `pkg:maven/com.google.code.gson/gson@2.8.0` | high | not_affected | needs_review | -| CVE-2021-36090 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | sound | -| CVE-2021-35516 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | sound | -| CVE-2021-35517 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | sound | -| CVE-2021-35515 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | sound | -| CVE-2024-25710 | `pkg:maven/org.apache.commons/commons-compress@1.9` | medium | not_affected | sound | -| CVE-2018-11771 | `pkg:maven/org.apache.commons/commons-compress@1.9` | medium | not_affected | sound | -| CVE-2022-34169 | `pkg:maven/xalan/xalan@2.7.2` | high | not_affected | needs_review | -| CVE-2018-1272 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2018-15756 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2026-41848 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2018-11040 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2018-1257 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2018-1271 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2018-1199 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2021-22096 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2026-41850 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2026-41851 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2026-41849 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | needs_review | -| CVE-2023-20863 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2023-20861 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2022-22950 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2026-41852 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2024-38808 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2023-20883 | `pkg:maven/org.springframework.boot/spring-boot-autoconfigure@1.5.4.RELEASE` | high | not_affected | needs_review | -| CVE-2024-23672 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15` | medium | not_affected | sound | -| CVE-2020-25638 | `pkg:maven/org.hibernate/hibernate-core@5.0.4.Final` | high | not_affected | needs_review | -| CVE-2019-14900 | `pkg:maven/org.hibernate/hibernate-core@5.0.4.Final` | medium | not_affected | sound | -| CVE-2017-7536 | `pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final` | high | not_affected | needs_review | -| CVE-2023-2976 | `pkg:maven/com.google.guava/guava@19.0` | high | not_affected | needs_review | -| CVE-2020-8908 | `pkg:maven/com.google.guava/guava@19.0` | low | not_affected | sound | -| CVE-2012-0881 | `pkg:maven/xerces/xercesimpl@2.11.0` | unknown | not_affected | sound | -| CVE-2013-4002 | `pkg:maven/xerces/xercesimpl@2.11.0` | unknown | not_affected | sound | -| CVE-2022-23437 | `pkg:maven/xerces/xercesimpl@2.11.0` | medium | not_affected | sound | -| CVE-2020-14338 | `pkg:maven/xerces/xercesimpl@2.11.0` | medium | not_affected | sound | -| CVE-2023-34055 | `pkg:maven/org.springframework.boot/spring-boot-actuator@1.5.4.RELEASE` | medium | not_affected | sound | -| CVE-2018-14042 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | -| CVE-2018-14040 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | -| CVE-2016-10735 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | -| CVE-2019-8331 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | -| CVE-2018-20677 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | -| CVE-2018-20676 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | sound | -| CVE-2020-15250 | `pkg:maven/junit/junit@4.12` | medium | not_affected | sound | -| CVE-2025-48924 | `pkg:maven/commons-lang/commons-lang@2.6` | medium | not_affected | sound | -| CVE-2025-48924 | `pkg:maven/org.apache.commons/commons-lang3@3.1` | medium | not_affected | sound | -| CVE-2019-3797 | `pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE` | medium | not_affected | sound | -| CVE-2019-3802 | `pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE` | medium | not_affected | sound | -| CVE-2022-22968 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2024-38820 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | medium | not_affected | sound | -| CVE-2025-22233 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | low | not_affected | sound | -| CVE-2020-13956 | `pkg:maven/org.apache.httpcomponents/httpclient@4.5.3` | medium | not_affected | sound | -| CVE-2021-29425 | `pkg:maven/commons-io/commons-io@2.4` | medium | not_affected | sound | -| CVE-2024-47554 | `pkg:maven/commons-io/commons-io@2.4` | medium | not_affected | sound | -| CVE-2025-49128 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8` | medium | not_affected | sound | -| CVE-2025-52999 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8` | unknown | not_affected | sound | +| CVE | Library | Severity | State | +|-----|---------|----------|-------| +| CVE-2020-10673 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-35728 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-35491 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-35490 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36184 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36182 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36180 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36186 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36181 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-10650 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36185 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36188 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36187 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36189 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36183 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2021-20190 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2018-5968 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-24616 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-24750 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2022-42004 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2022-42003 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2018-12023 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2020-36518 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2019-14439 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2018-12022 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | +| CVE-2019-12384 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | medium | not_affected | +| CVE-2019-12814 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | medium | not_affected | +| CVE-2023-26119 | `pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21` | critical | not_affected | +| CVE-2020-5529 | `pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21` | high | not_affected | +| CVE-2018-1000632 | `pkg:maven/dom4j/dom4j@1.6.1` | high | not_affected | +| CVE-2022-1471 | `pkg:maven/org.yaml/snakeyaml@1.17` | critical | not_affected | +| CVE-2022-25857 | `pkg:maven/org.yaml/snakeyaml@1.17` | high | not_affected | +| CVE-2017-18640 | `pkg:maven/org.yaml/snakeyaml@1.17` | high | not_affected | +| CVE-2022-38749 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | +| CVE-2022-41854 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | +| CVE-2022-38751 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | +| CVE-2022-38752 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | +| CVE-2022-38750 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | +| CVE-2018-1274 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | high | not_affected | +| CVE-2026-41716 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | high | not_affected | +| CVE-2026-41721 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | medium | not_affected | +| CVE-2026-41711 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | medium | not_affected | +| CVE-2018-1259 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | unknown | not_affected | +| CVE-2023-6378 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | high | not_affected | +| CVE-2021-42550 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | medium | not_affected | +| CVE-2026-10532 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | +| CVE-2026-1225 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | +| CVE-2026-9828 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | +| CVE-2025-11226 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | +| CVE-2024-12798 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | +| CVE-2024-12801 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | +| CVE-2024-22243 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | +| CVE-2024-22262 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | +| CVE-2024-22259 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | +| CVE-2018-11039 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | +| CVE-2024-38820 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | +| CVE-2024-38809 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | +| CVE-2026-41842 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | high | not_affected | +| CVE-2026-41845 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | +| CVE-2026-41846 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | +| CVE-2026-41844 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | +| CVE-2026-41841 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | +| CVE-2026-41843 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | +| CVE-2026-22745 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | +| CVE-2026-41853 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | +| CVE-2026-22741 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | low | not_affected | +| CVE-2023-6378 | `pkg:maven/ch.qos.logback/logback-classic@1.1.11` | high | not_affected | +| CVE-2022-22970 | `pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE` | medium | not_affected | +| CVE-2019-17563 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2023-46589 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2026-41284 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2026-43513 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2024-34750 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2025-49125 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2025-52434 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2022-42252 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2025-53506 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2025-52520 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2025-46701 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2019-12418 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2021-25329 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | +| CVE-2018-1305 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | +| CVE-2019-0221 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | +| CVE-2021-24122 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | +| CVE-2018-8037 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | +| CVE-2018-1304 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | +| CVE-2025-61795 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | +| CVE-2024-21733 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | +| CVE-2023-42795 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | +| CVE-2018-11784 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | +| CVE-2017-1000487 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | critical | not_affected | +| CVE-2025-67030 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | high | not_affected | +| CVE-2022-4244 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | high | not_affected | +| CVE-2022-4245 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | medium | not_affected | +| CVE-2019-20445 | `pkg:maven/io.netty/netty@3.5.7.Final` | critical | not_affected | +| CVE-2019-20444 | `pkg:maven/io.netty/netty@3.5.7.Final` | critical | not_affected | +| CVE-2021-37136 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | +| CVE-2021-37137 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | +| CVE-2019-16869 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | +| CVE-2021-43797 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | +| CVE-2021-21409 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | +| CVE-2021-21295 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | +| CVE-2021-21290 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | +| CVE-2015-2156 | `pkg:maven/io.netty/netty@3.5.7.Final` | unknown | not_affected | +| CVE-2026-2332 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | critical | not_affected | +| CVE-2025-11143 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | +| CVE-2024-6763 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | +| CVE-2023-40167 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | +| CVE-2022-2047 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | low | not_affected | +| CVE-2018-3258 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | high | not_affected | +| CVE-2023-22102 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | high | not_affected | +| CVE-2019-2692 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | medium | not_affected | +| CVE-2022-21363 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | unknown | not_affected | +| CVE-2026-22733 | `pkg:maven/org.springframework.boot/spring-boot-starter-actuator@1.5.4.RELEASE` | high | not_affected | +| CVE-2022-27772 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | +| CVE-2025-22235 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | +| CVE-2026-40973 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | +| CVE-2018-1196 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | medium | not_affected | +| CVE-2022-28366 | `pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21` | high | not_affected | +| CVE-2022-29546 | `pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21` | high | not_affected | +| CVE-2022-25647 | `pkg:maven/com.google.code.gson/gson@2.8.0` | high | not_affected | +| CVE-2021-36090 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | +| CVE-2021-35516 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | +| CVE-2021-35517 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | +| CVE-2021-35515 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | +| CVE-2024-25710 | `pkg:maven/org.apache.commons/commons-compress@1.9` | medium | not_affected | +| CVE-2018-11771 | `pkg:maven/org.apache.commons/commons-compress@1.9` | medium | not_affected | +| CVE-2018-1272 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | +| CVE-2018-15756 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | +| CVE-2026-41848 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | +| CVE-2018-11040 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | +| CVE-2018-1257 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | +| CVE-2018-1271 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | +| CVE-2018-1199 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | +| CVE-2021-22096 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | +| CVE-2026-41850 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | +| CVE-2026-41851 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | +| CVE-2026-41849 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | +| CVE-2023-20863 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | +| CVE-2023-20861 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | +| CVE-2022-22950 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | +| CVE-2026-41852 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | +| CVE-2024-38808 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | +| CVE-2023-20883 | `pkg:maven/org.springframework.boot/spring-boot-autoconfigure@1.5.4.RELEASE` | high | not_affected | +| CVE-2024-23672 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15` | medium | not_affected | +| CVE-2020-25638 | `pkg:maven/org.hibernate/hibernate-core@5.0.4.Final` | high | not_affected | +| CVE-2019-14900 | `pkg:maven/org.hibernate/hibernate-core@5.0.4.Final` | medium | not_affected | +| CVE-2017-7536 | `pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final` | high | not_affected | +| CVE-2023-2976 | `pkg:maven/com.google.guava/guava@19.0` | high | not_affected | +| CVE-2020-8908 | `pkg:maven/com.google.guava/guava@19.0` | low | not_affected | +| CVE-2012-0881 | `pkg:maven/xerces/xercesimpl@2.11.0` | unknown | not_affected | +| CVE-2013-4002 | `pkg:maven/xerces/xercesimpl@2.11.0` | unknown | not_affected | +| CVE-2022-23437 | `pkg:maven/xerces/xercesimpl@2.11.0` | medium | not_affected | +| CVE-2020-14338 | `pkg:maven/xerces/xercesimpl@2.11.0` | medium | not_affected | +| CVE-2023-34055 | `pkg:maven/org.springframework.boot/spring-boot-actuator@1.5.4.RELEASE` | medium | not_affected | +| CVE-2018-14042 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | +| CVE-2018-14040 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | +| CVE-2016-10735 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | +| CVE-2019-8331 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | +| CVE-2018-20677 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | +| CVE-2018-20676 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | +| CVE-2020-15250 | `pkg:maven/junit/junit@4.12` | medium | not_affected | +| CVE-2025-48924 | `pkg:maven/commons-lang/commons-lang@2.6` | medium | not_affected | +| CVE-2025-48924 | `pkg:maven/org.apache.commons/commons-lang3@3.1` | medium | not_affected | +| CVE-2019-3797 | `pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE` | medium | not_affected | +| CVE-2019-3802 | `pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE` | medium | not_affected | +| CVE-2022-22968 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | medium | not_affected | +| CVE-2024-38820 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | medium | not_affected | +| CVE-2025-22233 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | low | not_affected | +| CVE-2020-13956 | `pkg:maven/org.apache.httpcomponents/httpclient@4.5.3` | medium | not_affected | +| CVE-2021-29425 | `pkg:maven/commons-io/commons-io@2.4` | medium | not_affected | +| CVE-2024-47554 | `pkg:maven/commons-io/commons-io@2.4` | medium | not_affected | +| CVE-2025-49128 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8` | medium | not_affected | +| CVE-2025-52999 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8` | unknown | not_affected | -- **CVE-2018-14721** (needs_review): Critical (10.0) jackson-databind CVE accepted purely on 288 days without observed execution, not structural unreachability. -- **CVE-2018-11307** (needs_review): Critical severity, duration-only justification on a partially-loaded library (263/582 classes). -- **CVE-2017-17485** (needs_review): Critical, EPSS 0.5 (high exploit likelihood), duration-only acceptance is weak evidence for this deserialization CVE. -- **CVE-2020-8840** (needs_review): Critical jackson-databind gadget-chain CVE relying only on absence-of-observed-execution. -- **CVE-2019-16335** (needs_review): Critical severity, duration-only reasoning, library actively loaded. -- **CVE-2019-20330** (needs_review): Critical severity accepted on runtime silence alone. -- **CVE-2018-14718** (needs_review): Critical jackson-databind deserialization CVE, duration-only justification. -- **CVE-2018-14720** (needs_review): Critical severity, no structural reachability guarantee provided. -- **CVE-2018-14719** (needs_review): Critical severity, absence-of-execution is the sole basis for not_affected. -- **CVE-2020-9548** (needs_review): Critical severity, duration-based claim on library with substantial class usage. -- **CVE-2019-14540** (needs_review): Critical severity jackson-databind CVE, duration-only reasoning. -- **CVE-2020-9547** (needs_review): Critical severity, duration-only justification. -- **CVE-2019-14892** (needs_review): Critical severity, no code_not_reachable or protected_at_runtime backing. -- **CVE-2019-16942** (needs_review): Critical severity gadget-chain CVE accepted on runtime silence alone. -- **CVE-2018-19361** (needs_review): Critical severity, duration-only reasoning. -- **CVE-2019-16943** (needs_review): Critical severity, duration-only justification. -- **CVE-2018-19360** (needs_review): Critical severity, absence-of-evidence acceptance. -- **CVE-2018-19362** (needs_review): Critical severity, duration-only justification. -- **CVE-2019-17267** (needs_review): Critical severity gadget-chain CVE, no structural guarantee. -- **CVE-2017-7525** (needs_review): Critical, EPSS 0.38, duration-only reasoning on a well-known deserialization CVE. -- **CVE-2018-7489** (needs_review): Critical severity, EPSS 0.2, duration-only justification. -- **CVE-2019-17531** (needs_review): Critical severity, no structural reachability evidence. -- **CVE-2017-15095** (needs_review): Critical severity, duration-only acceptance. -- **CVE-2019-14379** (needs_review): Critical severity jackson-databind CVE, duration-only justification. -- **CVE-2020-10673** (needs_review): High severity (8.8), duration-only reasoning without structural backing. -- **CVE-2020-35728** (needs_review): High severity, duration-only justification. -- **CVE-2020-35491** (needs_review): High severity, duration-only justification. -- **CVE-2020-35490** (needs_review): High severity, duration-only justification. -- **CVE-2020-36184** (needs_review): High severity, duration-only justification. -- **CVE-2020-36182** (needs_review): High severity, duration-only justification. -- **CVE-2020-36180** (needs_review): High severity, duration-only justification. -- **CVE-2020-36186** (needs_review): High severity, duration-only justification. -- **CVE-2020-36181** (needs_review): High severity, duration-only justification. -- **CVE-2020-36179** (needs_review): High severity, duration-only justification. -- **CVE-2020-10650** (needs_review): High severity, duration-only justification. -- **CVE-2020-36185** (needs_review): High severity, duration-only justification. -- **CVE-2020-36188** (needs_review): High severity, duration-only justification. -- **CVE-2020-36187** (needs_review): High severity, duration-only justification. -- **CVE-2020-36189** (needs_review): High severity, duration-only justification. -- **CVE-2020-36183** (needs_review): High severity, duration-only justification. -- **CVE-2021-20190** (needs_review): High severity, duration-only justification. -- **CVE-2018-5968** (needs_review): High severity, duration-only justification. -- **CVE-2020-24616** (needs_review): High severity, duration-only justification. -- **CVE-2020-24750** (needs_review): High severity, duration-only justification. -- **CVE-2022-42004** (needs_review): High severity, duration-only justification. -- **CVE-2022-42003** (needs_review): High severity, duration-only justification. -- **CVE-2020-25649** (needs_review): High severity, duration-only justification. -- **CVE-2018-12023** (needs_review): High severity, duration-only justification. -- **CVE-2020-36518** (needs_review): High severity, duration-only justification. -- **CVE-2019-14439** (needs_review): High severity, duration-only justification. -- **CVE-2018-12022** (needs_review): High severity, duration-only justification. -- **CVE-2019-12086** (needs_review): High severity, EPSS 0.22, duration-only justification. -- **CVE-2019-12384** (sound): Medium severity; duration-based acceptance is acceptable at this stakes level. -- **CVE-2019-12814** (sound): Medium severity; duration-based acceptance is reasonable. -- **CVE-2023-26119** (sound): code_not_reachable with 0 of 1295 classes loaded is a structural fact, safe regardless of critical severity. -- **CVE-2020-5529** (sound): code_not_reachable, structural non-reachability, safe to rely on. -- **CVE-2020-10683** (needs_review): Critical severity dom4j XXE CVE accepted on duration alone; only 1 of 190 classes loaded but that single class could be the vulnerable path. -- **CVE-2018-1000632** (needs_review): High severity, duration-only justification with minimal (1/190) class usage - worth confirming that one class isn't the vulnerable path. -- **CVE-2022-1471** (sound): code_not_reachable (0 of 206 classes) is structural, safe despite critical severity/EPSS 1.0. -- **CVE-2022-25857** (sound): code_not_reachable, structural non-reachability. -- **CVE-2017-18640** (sound): code_not_reachable, structural non-reachability. -- **CVE-2022-38749** (sound): code_not_reachable, medium severity, low stakes. -- **CVE-2022-41854** (sound): code_not_reachable, medium severity. -- **CVE-2022-38751** (sound): code_not_reachable, medium severity. -- **CVE-2022-38752** (sound): code_not_reachable, medium severity. -- **CVE-2022-38750** (sound): code_not_reachable, medium severity. -- **CVE-2022-22965** (needs_review): For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes). -- **CVE-2018-1273** (needs_review): Critical, KEV-listed, EPSS 0.97 spring-data-commons RCE accepted purely on duration with the library substantially loaded (152/554 classes) - high priority for human review. -- **CVE-2018-1274** (needs_review): High severity, duration-only justification on same actively-loaded library. -- **CVE-2026-41716** (needs_review): High severity CVE accepted on duration alone, though EPSS is negligible. -- **CVE-2026-41721** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2026-41711** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2018-1259** (sound): Unknown/no severity score, low stakes. -- **CVE-2022-41853** (needs_review): Critical severity hsqldb CVE accepted purely on duration, library substantially loaded (229/601 classes). -- **CVE-2017-5929** (needs_review): For logback-classic: critical severity, duration-only justification with library actively loaded (63/178 classes). -- **CVE-2023-6378** (needs_review): For logback-classic: high severity, duration-only justification. -- **CVE-2021-42550** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2026-10532** (sound): Unknown severity, low stakes. -- **CVE-2026-1225** (sound): Unknown severity, low stakes. -- **CVE-2026-9828** (sound): Unknown severity, low stakes. -- **CVE-2025-11226** (sound): Unknown severity, low stakes. -- **CVE-2024-12798** (sound): Unknown severity, low stakes. -- **CVE-2024-12801** (sound): Unknown severity, low stakes. -- **CVE-2016-1000027** (needs_review): Critical severity spring-web CVE, EPSS 0.32, duration-only justification. -- **CVE-2024-22243** (needs_review): High severity, duration-only justification. -- **CVE-2024-22262** (needs_review): High severity, duration-only justification. -- **CVE-2024-22259** (needs_review): High severity, duration-only justification. -- **CVE-2018-11039** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2024-38820** (sound): For spring-context: medium severity, duration-based acceptance reasonable. -- **CVE-2024-38809** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2022-22965** (needs_review): For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes). -- **CVE-2026-41842** (needs_review): High severity, duration-only justification. -- **CVE-2024-38819** (needs_review): High severity, EPSS 0.55, duration-only justification. -- **CVE-2026-41845** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2026-41846** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2026-41844** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2026-41841** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2026-41843** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2026-22745** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2026-41853** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2026-22741** (sound): Low severity, duration-based acceptance is fine. -- **CVE-2017-5929** (needs_review): For logback-classic: critical severity, duration-only justification with library actively loaded (63/178 classes). -- **CVE-2023-6378** (needs_review): For logback-classic: high severity, duration-only justification. -- **CVE-2022-22965** (needs_review): For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes). -- **CVE-2022-22970** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2018-8014** (needs_review): Critical severity tomcat-embed-core CVE, duration-only justification, library heavily loaded (387/1481 classes). -- **CVE-2025-24813** (needs_review): Critical, KEV-listed, EPSS 1.0 Tomcat path equality RCE accepted purely on duration despite heavy library usage - top priority review. -- **CVE-2026-43512** (needs_review): Critical severity, duration-only justification. -- **CVE-2020-1938** (needs_review): Critical, KEV-listed (Ghostcat), EPSS 0.99, accepted purely on duration - top priority review. -- **CVE-2025-31651** (needs_review): Critical severity, duration-only justification. -- **CVE-2024-50379** (needs_review): Critical severity, EPSS 0.44, duration-only justification. -- **CVE-2026-43515** (needs_review): Critical severity, duration-only justification. -- **CVE-2019-0232** (needs_review): High severity, EPSS 1.0, duration-only justification. -- **CVE-2017-12617** (needs_review): High severity, KEV-listed, EPSS 1.0, duration-only justification - top priority review. -- **CVE-2019-0199** (needs_review): High severity, EPSS 0.73, duration-only justification. -- **CVE-2018-8034** (needs_review): High severity, duration-only justification. -- **CVE-2019-17563** (needs_review): High severity, duration-only justification. -- **CVE-2023-46589** (needs_review): High severity, duration-only justification. -- **CVE-2025-55752** (needs_review): High severity, EPSS 0.67, duration-only justification. -- **CVE-2026-41284** (needs_review): High severity, duration-only justification. -- **CVE-2019-10072** (needs_review): High severity, EPSS 0.73, duration-only justification. -- **CVE-2026-43513** (needs_review): High severity, duration-only justification. -- **CVE-2021-25122** (needs_review): High severity, duration-only justification. -- **CVE-2024-34750** (needs_review): High severity, duration-only justification. -- **CVE-2025-48988** (needs_review): High severity, EPSS 0.57, duration-only justification. -- **CVE-2025-49125** (needs_review): High severity, duration-only justification. -- **CVE-2025-52434** (needs_review): High severity, duration-only justification. -- **CVE-2022-42252** (needs_review): High severity, duration-only justification. -- **CVE-2025-53506** (needs_review): High severity, duration-only justification. -- **CVE-2025-52520** (needs_review): High severity, duration-only justification. -- **CVE-2025-31650** (needs_review): High severity, EPSS 0.6, duration-only justification. -- **CVE-2024-24549** (needs_review): High severity, EPSS 0.23, duration-only justification. -- **CVE-2023-44487** (needs_review): High severity, KEV-listed (HTTP/2 Rapid Reset), EPSS 1.0, duration-only justification - priority review. -- **CVE-2018-1336** (needs_review): High severity, duration-only justification. -- **CVE-2025-46701** (needs_review): High severity, duration-only justification. -- **CVE-2019-12418** (needs_review): High severity, duration-only justification. -- **CVE-2021-25329** (needs_review): High severity, duration-only justification. -- **CVE-2020-9484** (needs_review): High severity, EPSS 0.57, duration-only justification. -- **CVE-2018-1305** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2019-0221** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2021-24122** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2018-8037** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2018-1304** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2025-61795** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2024-21733** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2023-42795** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2018-11784** (sound): Medium severity; despite unusually high EPSS (0.94), lower stakes than critical/high per policy, acceptable on duration. -- **CVE-2017-1000487** (sound): code_not_reachable, structural non-reachability, safe despite critical severity. -- **CVE-2025-67030** (sound): code_not_reachable, structural non-reachability. -- **CVE-2022-4244** (sound): code_not_reachable, structural non-reachability. -- **CVE-2022-4245** (sound): code_not_reachable, structural non-reachability. -- **CVE-2019-20445** (sound): code_not_reachable, structural non-reachability, safe despite critical severity. -- **CVE-2019-20444** (sound): code_not_reachable, structural non-reachability. -- **CVE-2021-37136** (sound): code_not_reachable, structural non-reachability. -- **CVE-2021-37137** (sound): code_not_reachable, structural non-reachability. -- **CVE-2019-16869** (sound): code_not_reachable, structural non-reachability. -- **CVE-2021-43797** (sound): code_not_reachable, structural non-reachability. -- **CVE-2021-21409** (sound): code_not_reachable, structural non-reachability. -- **CVE-2021-21295** (sound): code_not_reachable, structural non-reachability. -- **CVE-2021-21290** (sound): code_not_reachable, structural non-reachability. -- **CVE-2015-2156** (sound): code_not_reachable, structural non-reachability. -- **CVE-2026-2332** (sound): code_not_reachable, structural non-reachability, safe despite critical severity. -- **CVE-2025-11143** (sound): code_not_reachable, structural non-reachability. -- **CVE-2024-6763** (sound): code_not_reachable, structural non-reachability. -- **CVE-2023-40167** (sound): code_not_reachable, structural non-reachability. -- **CVE-2022-2047** (sound): code_not_reachable, structural non-reachability. -- **CVE-2026-41901** (needs_review): Critical severity thymeleaf CVE, duration-only justification, library heavily loaded (367/549 classes). -- **CVE-2026-40477** (needs_review): Critical severity, duration-only justification. -- **CVE-2026-40478** (needs_review): Critical severity, duration-only justification. -- **CVE-2018-3258** (needs_review): High severity mysql-connector CVE, duration-only justification. -- **CVE-2023-22102** (needs_review): High severity, duration-only justification. -- **CVE-2019-2692** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2022-21363** (sound): Unknown severity, low stakes. -- **CVE-2026-22733** (sound): code_not_reachable (0 of 0 classes), consistent with starter POM containing no code, safe despite high severity. -- **CVE-2022-27772** (needs_review): High severity spring-boot CVE, duration-only justification. -- **CVE-2025-22235** (needs_review): High severity, duration-only justification. -- **CVE-2026-40973** (needs_review): High severity, duration-only justification. -- **CVE-2018-1196** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2022-28366** (sound): code_not_reachable, structural non-reachability. -- **CVE-2022-29546** (sound): code_not_reachable, structural non-reachability. -- **CVE-2022-25647** (needs_review): High severity gson CVE, duration-only justification with library actively loaded (36/174 classes). -- **CVE-2021-36090** (sound): code_not_reachable, structural non-reachability. -- **CVE-2021-35516** (sound): code_not_reachable, structural non-reachability. -- **CVE-2021-35517** (sound): code_not_reachable, structural non-reachability. -- **CVE-2021-35515** (sound): code_not_reachable, structural non-reachability. -- **CVE-2024-25710** (sound): code_not_reachable, medium severity. -- **CVE-2018-11771** (sound): code_not_reachable, medium severity. -- **CVE-2022-34169** (needs_review): High severity, EPSS 0.81 xalan CVE, duration-only justification despite very low class usage (7/1501) - worth confirming those 7 classes aren't the vulnerable path. -- **CVE-2018-1272** (needs_review): High severity spring-core CVE, duration-only justification, library heavily loaded (334/791 classes). -- **CVE-2018-15756** (needs_review): High severity, duration-only justification. -- **CVE-2026-41848** (needs_review): High severity, duration-only justification. -- **CVE-2018-11040** (needs_review): High severity, duration-only justification. -- **CVE-2018-1257** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2018-1271** (sound): Medium severity, duration-based acceptance reasonable despite elevated EPSS (0.35). -- **CVE-2018-1199** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2021-22096** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2026-41850** (needs_review): High severity spring-expression CVE, duration-only justification, library heavily loaded (91/142 classes). -- **CVE-2026-41851** (needs_review): High severity, duration-only justification. -- **CVE-2026-41849** (needs_review): High severity, duration-only justification. -- **CVE-2023-20863** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2023-20861** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2022-22950** (sound): Medium severity, duration-based acceptance reasonable despite EPSS 0.36. -- **CVE-2026-41852** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2024-38808** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2023-20883** (needs_review): High severity spring-boot-autoconfigure CVE, duration-only justification, library well-loaded (195/848 classes). -- **CVE-2024-23672** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2020-25638** (needs_review): High severity hibernate-core CVE, duration-only justification, library heavily loaded (1563/3787 classes). -- **CVE-2019-14900** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2017-7536** (needs_review): High severity hibernate-validator CVE, duration-only justification, library well-loaded (225/459 classes). -- **CVE-2023-2976** (needs_review): High severity guava CVE, duration-only justification, though usage is minimal (5/1717 classes). -- **CVE-2020-8908** (sound): Low severity, duration-based acceptance reasonable. -- **CVE-2012-0881** (sound): Unknown severity, low stakes. -- **CVE-2013-4002** (sound): Unknown severity, low stakes. -- **CVE-2022-23437** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2020-14338** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2023-34055** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2018-14042** (sound): code_not_reachable, structural non-reachability. -- **CVE-2018-14040** (sound): code_not_reachable, structural non-reachability. -- **CVE-2016-10735** (sound): code_not_reachable, structural non-reachability. -- **CVE-2019-8331** (sound): code_not_reachable, structural non-reachability. -- **CVE-2018-20677** (sound): code_not_reachable, structural non-reachability. -- **CVE-2018-20676** (sound): code_not_reachable, structural non-reachability. -- **CVE-2020-15250** (sound): code_not_reachable, structural non-reachability (test-scope library). -- **CVE-2025-48924** (sound): For commons-lang3: code_not_reachable, structural non-reachability. -- **CVE-2025-48924** (sound): For commons-lang3: code_not_reachable, structural non-reachability. -- **CVE-2019-3797** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2019-3802** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2022-22968** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2024-38820** (sound): For spring-context: medium severity, duration-based acceptance reasonable. -- **CVE-2025-22233** (sound): Low severity, duration-based acceptance reasonable. -- **CVE-2020-13956** (sound): code_not_reachable, structural non-reachability. -- **CVE-2021-29425** (sound): code_not_reachable, structural non-reachability. -- **CVE-2024-47554** (sound): code_not_reachable, structural non-reachability. -- **CVE-2025-49128** (sound): Medium severity, duration-based acceptance reasonable. -- **CVE-2025-52999** (sound): Unknown severity, low stakes. +
--- diff --git a/samples/sample-vex.json b/samples/sample-vex.json index fd44abe..4068d9d 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -3,7 +3,7 @@ "specVersion": "1.6", "version": 1, "metadata": { - "timestamp": "2026-09-02T21:36:56Z", + "timestamp": "2026-09-02T22:10:38Z", "component": { "type": "application", "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", @@ -117,7 +117,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (10.0) jackson-databind CVE accepted purely on 288 days without observed execution, not structural unreachability." + "value": "Critical (10.0) accepted solely on 288 days of non-execution with no structural non-reachability; jackson-databind deserialization CVEs of this class are historically found reachable unexpectedly." } ] }, @@ -227,7 +227,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification on a partially-loaded library (263/582 classes)." + "value": "Critical (9.8) accepted on duration alone; no code_not_reachable backing." } ] }, @@ -337,7 +337,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, EPSS 0.5 (high exploit likelihood), duration-only acceptance is weak evidence for this deserialization CVE." + "value": "Critical (9.8) with elevated EPSS (0.5, 98.8th pct) accepted purely on non-execution duration; warrants a closer look." } ] }, @@ -447,7 +447,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical jackson-databind gadget-chain CVE relying only on absence-of-observed-execution." + "value": "Critical (9.8), EPSS 0.27, duration-only justification - worth a manual check." } ] }, @@ -557,7 +557,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning, library actively loaded." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -667,7 +667,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity accepted on runtime silence alone." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -777,7 +777,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical jackson-databind deserialization CVE, duration-only justification." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -887,7 +887,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, no structural reachability guarantee provided." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -997,7 +997,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, absence-of-execution is the sole basis for not_affected." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -1107,7 +1107,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-based claim on library with substantial class usage." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -1217,7 +1217,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity jackson-databind CVE, duration-only reasoning." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -1327,7 +1327,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -1437,7 +1437,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, no code_not_reachable or protected_at_runtime backing." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -1547,7 +1547,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity gadget-chain CVE accepted on runtime silence alone." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -1657,7 +1657,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -1767,7 +1767,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -1877,7 +1877,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, absence-of-evidence acceptance." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -1987,7 +1987,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -2097,7 +2097,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity gadget-chain CVE, no structural guarantee." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -2207,7 +2207,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, EPSS 0.38, duration-only reasoning on a well-known deserialization CVE." + "value": "Critical (9.8), EPSS 0.38, duration-only - the well-known jackson polymorphic-deserialization gadget class, worth verifying." } ] }, @@ -2317,7 +2317,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, EPSS 0.2, duration-only justification." + "value": "Critical (9.8), EPSS 0.2, accepted solely on non-execution duration." } ] }, @@ -2427,7 +2427,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, no structural reachability evidence." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -2537,7 +2537,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only acceptance." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -2647,7 +2647,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity jackson-databind CVE, duration-only justification." + "value": "Critical (9.8) accepted solely on non-execution duration." } ] }, @@ -2753,11 +2753,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity (8.8), duration-only reasoning without structural backing." + "value": "High severity but low EPSS (0.08); 288 days is well past the 30-day threshold, acceptable to rely on." } ] }, @@ -2863,11 +2863,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, EPSS 0.13, duration comfortably exceeds threshold; reasonable to accept." } ] }, @@ -2973,11 +2973,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.09); acceptable duration-based claim." } ] }, @@ -3083,11 +3083,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.08); acceptable duration-based claim." } ] }, @@ -3193,11 +3193,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.1); acceptable duration-based claim." } ] }, @@ -3303,11 +3303,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.05); acceptable." } ] }, @@ -3413,11 +3413,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.05); acceptable." } ] }, @@ -3523,11 +3523,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.05); acceptable." } ] }, @@ -3633,11 +3633,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.05); acceptable." } ] }, @@ -3747,7 +3747,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity with EPSS 0.21 (97th pct) accepted on duration alone; worth a closer look." } ] }, @@ -3853,11 +3853,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, very low EPSS (0.03); acceptable." } ] }, @@ -3963,11 +3963,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.05); acceptable." } ] }, @@ -4073,11 +4073,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, EPSS 0.11; acceptable given long observation window." } ] }, @@ -4183,11 +4183,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.05); acceptable." } ] }, @@ -4293,11 +4293,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.05); acceptable." } ] }, @@ -4403,11 +4403,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.05); acceptable." } ] }, @@ -4513,11 +4513,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.07); acceptable." } ] }, @@ -4623,11 +4623,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.07); acceptable." } ] }, @@ -4733,11 +4733,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.09); acceptable." } ] }, @@ -4843,11 +4843,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.07); acceptable." } ] }, @@ -4953,11 +4953,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity (7.5), low EPSS (0.03); acceptable." } ] }, @@ -5063,11 +5063,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity (7.5), low EPSS (0.03); acceptable." } ] }, @@ -5177,7 +5177,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity with EPSS 0.18 (97th pct) accepted purely on duration; worth verifying." } ] }, @@ -5283,11 +5283,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.09); acceptable." } ] }, @@ -5393,11 +5393,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.05); acceptable." } ] }, @@ -5503,11 +5503,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, EPSS 0.11; acceptable." } ] }, @@ -5613,11 +5613,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.07); acceptable." } ] }, @@ -5727,7 +5727,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.22, duration-only justification." + "value": "High severity with EPSS 0.22 (97th pct) accepted purely on non-execution duration; worth verifying." } ] }, @@ -5837,7 +5837,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance is acceptable at this stakes level." + "value": "Medium severity; duration-based acceptance is reasonable at this severity." } ] }, @@ -5947,7 +5947,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance is reasonable." + "value": "Medium severity; duration-based acceptance is reasonable at this severity." } ] }, @@ -6055,7 +6055,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable with 0 of 1295 classes loaded is a structural fact, safe regardless of critical severity." + "value": "code_not_reachable, 0 of 1295 classes ever loaded - a structural fact, safe regardless of critical severity." } ] }, @@ -6163,7 +6163,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability, safe to rely on." + "value": "code_not_reachable, zero classes loaded - structural, safe to rely on." } ] }, @@ -6273,7 +6273,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity dom4j XXE CVE accepted on duration alone; only 1 of 190 classes loaded but that single class could be the vulnerable path." + "value": "Critical (9.8) dom4j XXE, only 1 of 190 classes ever used, but that one class is loaded and the claim relies purely on non-execution duration - worth confirming that class isn\u0027t the vulnerable entry point." } ] }, @@ -6379,11 +6379,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification with minimal (1/190) class usage - worth confirming that one class isn\u0027t the vulnerable path." + "value": "High severity but low EPSS (0.07); duration-based acceptance reasonable." } ] }, @@ -6491,7 +6491,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable (0 of 206 classes) is structural, safe despite critical severity/EPSS 1.0." + "value": "code_not_reachable despite very high EPSS (1.0) - zero classes loaded is a structural fact independent of exploit prevalence." } ] }, @@ -6599,7 +6599,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -6707,7 +6707,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -6815,7 +6815,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity, low stakes." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -6923,7 +6923,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -7031,7 +7031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -7139,7 +7139,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -7247,7 +7247,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -7355,7 +7355,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes)." + "value": "KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review." } ] }, @@ -7465,7 +7465,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed, EPSS 0.97 spring-data-commons RCE accepted purely on duration with the library substantially loaded (152/554 classes) - high priority for human review." + "value": "KEV-listed, critical (9.8), EPSS 0.97 (99.9th pct) - one of the most exploitable CVEs in this VEX set, yet accepted purely on non-execution duration. Requires explicit human verification, not automated acceptance." } ] }, @@ -7571,11 +7571,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on same actively-loaded library." + "value": "High severity but low EPSS (0.02); acceptable given long observation." } ] }, @@ -7681,11 +7681,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted on duration alone, though EPSS is negligible." + "value": "High severity, negligible EPSS (0.0); acceptable." } ] }, @@ -7795,7 +7795,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -7905,7 +7905,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -8013,7 +8013,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown/no severity score, low stakes." + "value": "Unscored/unknown severity; low stakes." } ] }, @@ -8123,7 +8123,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity hsqldb CVE accepted purely on duration, library substantially loaded (229/601 classes)." + "value": "Critical (9.8) accepted solely on non-execution duration despite substantial hsqldb usage (229/601 classes) - worth confirming." } ] }, @@ -8233,7 +8233,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "For logback-classic: critical severity, duration-only justification with library actively loaded (63/178 classes)." + "value": "Critical (9.8) on logback-classic, same underlying gap as the logback-core instance: accepted purely on non-execution duration." } ] }, @@ -8339,11 +8339,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "For logback-classic: high severity, duration-only justification." + "value": "High severity but very low EPSS (0.01); acceptable." } ] }, @@ -8453,7 +8453,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -8561,7 +8561,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes." + "value": "Unscored severity; low stakes." } ] }, @@ -8669,7 +8669,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes." + "value": "Unscored severity; low stakes." } ] }, @@ -8777,7 +8777,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes." + "value": "Unscored severity; low stakes." } ] }, @@ -8885,7 +8885,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes." + "value": "Unscored severity; low stakes." } ] }, @@ -8993,7 +8993,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes." + "value": "Unscored severity; low stakes." } ] }, @@ -9101,7 +9101,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes." + "value": "Unscored severity; low stakes." } ] }, @@ -9211,7 +9211,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity spring-web CVE, EPSS 0.32, duration-only justification." + "value": "Critical (9.8) spring-web deserialization CVE accepted solely on non-execution duration despite meaningful library usage (211/559 classes); worth verifying." } ] }, @@ -9317,11 +9317,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.04); acceptable." } ] }, @@ -9427,11 +9427,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, very low EPSS (0.01); acceptable." } ] }, @@ -9537,11 +9537,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.03); acceptable." } ] }, @@ -9651,7 +9651,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -9761,7 +9761,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "For spring-context: medium severity, duration-based acceptance reasonable." + "value": "Medium severity on spring-context; acceptable." } ] }, @@ -9871,7 +9871,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -9981,7 +9981,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes)." + "value": "KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review." } ] }, @@ -10087,11 +10087,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, negligible EPSS (0.0); acceptable." } ] }, @@ -10201,7 +10201,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.55, duration-only justification." + "value": "High severity with elevated EPSS (0.55, 99th pct) accepted purely on non-execution duration; worth verifying." } ] }, @@ -10311,7 +10311,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -10421,7 +10421,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -10531,7 +10531,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -10641,7 +10641,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -10751,7 +10751,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -10861,7 +10861,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -10971,7 +10971,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -11081,7 +11081,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, duration-based acceptance is fine." + "value": "Low severity; acceptable." } ] }, @@ -11191,7 +11191,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "For logback-classic: critical severity, duration-only justification with library actively loaded (63/178 classes)." + "value": "Critical (9.8) on logback-classic, same underlying gap as the logback-core instance: accepted purely on non-execution duration." } ] }, @@ -11297,11 +11297,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "For logback-classic: high severity, duration-only justification." + "value": "High severity but very low EPSS (0.01); acceptable." } ] }, @@ -11411,7 +11411,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "For spring-beans: Spring4Shell, critical, KEV-listed, duration-only justification with library substantially loaded (202/408 classes)." + "value": "KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review." } ] }, @@ -11521,7 +11521,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -11631,7 +11631,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity tomcat-embed-core CVE, duration-only justification, library heavily loaded (387/1481 classes)." + "value": "Critical (9.8) on heavily-used tomcat-embed-core (387/1481 classes), accepted purely on non-execution duration." } ] }, @@ -11741,7 +11741,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed, EPSS 1.0 Tomcat path equality RCE accepted purely on duration despite heavy library usage - top priority review." + "value": "KEV-listed, critical (9.8), EPSS 1.0 - among the most exploitable CVEs in this set, accepted purely on duration; requires human verification." } ] }, @@ -11851,7 +11851,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Critical (9.8) accepted purely on non-execution duration on a heavily-loaded library." } ] }, @@ -11961,7 +11961,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed (Ghostcat), EPSS 0.99, accepted purely on duration - top priority review." + "value": "KEV-listed (Ghostcat), critical (9.8), EPSS 0.99 - requires human verification rather than duration-only acceptance." } ] }, @@ -12071,7 +12071,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Critical (9.8) accepted purely on non-execution duration." } ] }, @@ -12181,7 +12181,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, EPSS 0.44, duration-only justification." + "value": "Critical (9.8), EPSS 0.44, accepted purely on non-execution duration." } ] }, @@ -12291,7 +12291,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Critical (9.1) accepted purely on non-execution duration." } ] }, @@ -12401,7 +12401,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 1.0, duration-only justification." + "value": "High severity with EPSS 1.0 (near-certain exploitation observed elsewhere) accepted purely on non-execution duration." } ] }, @@ -12511,7 +12511,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, KEV-listed, EPSS 1.0, duration-only justification - top priority review." + "value": "KEV-listed, EPSS 1.0 - requires human verification rather than duration-only acceptance." } ] }, @@ -12621,7 +12621,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.73, duration-only justification." + "value": "High severity, EPSS 0.73, accepted purely on non-execution duration." } ] }, @@ -12731,7 +12731,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, EPSS 0.21, accepted purely on non-execution duration." } ] }, @@ -12837,11 +12837,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity but EPSS below 0.15 (0.11); acceptable given long observation." } ] }, @@ -12947,11 +12947,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.03); acceptable." } ] }, @@ -13061,7 +13061,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.67, duration-only justification." + "value": "High severity, EPSS 0.67, accepted purely on non-execution duration." } ] }, @@ -13167,11 +13167,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.01); acceptable." } ] }, @@ -13281,7 +13281,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.73, duration-only justification." + "value": "High severity, EPSS 0.73, accepted purely on non-execution duration." } ] }, @@ -13387,11 +13387,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, negligible EPSS (0.0); acceptable." } ] }, @@ -13501,7 +13501,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, EPSS 0.18, accepted purely on non-execution duration." } ] }, @@ -13607,11 +13607,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.05); acceptable." } ] }, @@ -13721,7 +13721,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.57, duration-only justification." + "value": "High severity, EPSS 0.57, accepted purely on non-execution duration." } ] }, @@ -13827,11 +13827,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.03); acceptable." } ] }, @@ -13937,11 +13937,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.02); acceptable." } ] }, @@ -14047,11 +14047,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.02); acceptable." } ] }, @@ -14157,11 +14157,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.02); acceptable." } ] }, @@ -14267,11 +14267,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.02); acceptable." } ] }, @@ -14381,7 +14381,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.6, duration-only justification." + "value": "High severity, EPSS 0.6, accepted purely on non-execution duration." } ] }, @@ -14491,7 +14491,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.23, duration-only justification." + "value": "High severity, EPSS 0.23, accepted purely on non-execution duration." } ] }, @@ -14601,7 +14601,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, KEV-listed (HTTP/2 Rapid Reset), EPSS 1.0, duration-only justification - priority review." + "value": "KEV-listed (HTTP/2 Rapid Reset), EPSS 1.0 - requires human verification rather than duration-only acceptance." } ] }, @@ -14711,7 +14711,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, EPSS 0.21, accepted purely on non-execution duration." } ] }, @@ -14817,11 +14817,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.03); acceptable." } ] }, @@ -14927,11 +14927,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, very low EPSS (0.01); acceptable." } ] }, @@ -15037,11 +15037,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.09); acceptable." } ] }, @@ -15151,7 +15151,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.57, duration-only justification." + "value": "High severity, EPSS 0.57, accepted purely on non-execution duration." } ] }, @@ -15261,7 +15261,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -15371,7 +15371,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -15481,7 +15481,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -15591,7 +15591,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -15701,7 +15701,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -15811,7 +15811,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -15921,7 +15921,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -16031,7 +16031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -16141,7 +16141,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; despite unusually high EPSS (0.94), lower stakes than critical/high per policy, acceptable on duration." + "value": "Medium severity despite high EPSS; below the critical/high threshold the rubric targets, and duration is well past policy minimum." } ] }, @@ -16249,7 +16249,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability, safe despite critical severity." + "value": "code_not_reachable, structural, safe to rely on despite critical severity." } ] }, @@ -16357,7 +16357,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -16465,7 +16465,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -16573,7 +16573,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -16681,7 +16681,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability, safe despite critical severity." + "value": "code_not_reachable, structural, safe to rely on despite critical severity." } ] }, @@ -16789,7 +16789,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -16897,7 +16897,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -17005,7 +17005,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -17113,7 +17113,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -17221,7 +17221,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -17329,7 +17329,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -17437,7 +17437,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -17545,7 +17545,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -17651,7 +17651,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -17759,7 +17759,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability, safe despite critical severity." + "value": "code_not_reachable, structural, safe to rely on despite critical severity." } ] }, @@ -17867,7 +17867,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -17975,7 +17975,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -18083,7 +18083,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -18191,7 +18191,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -18301,7 +18301,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity thymeleaf CVE, duration-only justification, library heavily loaded (367/549 classes)." + "value": "Critical (9.0) thymeleaf CVE accepted solely on non-execution duration despite substantial library usage (367/549 classes); worth verifying." } ] }, @@ -18411,7 +18411,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Critical (9.0) accepted solely on non-execution duration." } ] }, @@ -18521,7 +18521,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Critical (9.0) accepted solely on non-execution duration." } ] }, @@ -18627,11 +18627,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity mysql-connector CVE, duration-only justification." + "value": "High severity, low EPSS (0.04); acceptable, and library usage is minimal (4/347 classes)." } ] }, @@ -18737,11 +18737,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, very low EPSS (0.01); acceptable." } ] }, @@ -18851,7 +18851,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -18959,7 +18959,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes." + "value": "Unscored severity; low stakes." } ] }, @@ -19067,7 +19067,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable (0 of 0 classes), consistent with starter POM containing no code, safe despite high severity." + "value": "code_not_reachable, 0 of 0 classes loaded, structural, safe to rely on." } ] }, @@ -19173,11 +19173,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-boot CVE, duration-only justification." + "value": "High severity, very low EPSS (0.01); acceptable." } ] }, @@ -19283,11 +19283,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, negligible EPSS (0.0); acceptable." } ] }, @@ -19393,11 +19393,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, negligible EPSS (0.0); acceptable." } ] }, @@ -19507,7 +19507,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -19615,7 +19615,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -19723,7 +19723,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -19829,11 +19829,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity gson CVE, duration-only justification with library actively loaded (36/174 classes)." + "value": "High severity but EPSS just under the 0.15 flag threshold (0.12); acceptable given long observation, though close enough to note if reviewing anyway." } ] }, @@ -19941,7 +19941,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -20049,7 +20049,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -20157,7 +20157,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -20265,7 +20265,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -20373,7 +20373,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -20481,7 +20481,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -20591,7 +20591,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.81 xalan CVE, duration-only justification despite very low class usage (7/1501) - worth confirming those 7 classes aren\u0027t the vulnerable path." + "value": "High severity with very high EPSS (0.81, 99.6th pct) accepted purely on non-execution duration despite the library being loaded (7/1501 classes) - worth verifying given the strong exploitability signal." } ] }, @@ -20697,11 +20697,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-core CVE, duration-only justification, library heavily loaded (334/791 classes)." + "value": "High severity, low EPSS (0.03); acceptable." } ] }, @@ -20807,11 +20807,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, EPSS 0.09; acceptable." } ] }, @@ -20917,11 +20917,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, negligible EPSS; acceptable." } ] }, @@ -21027,11 +21027,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, low EPSS (0.03); acceptable." } ] }, @@ -21141,7 +21141,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -21251,7 +21251,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable despite elevated EPSS (0.35)." + "value": "Medium severity; acceptable." } ] }, @@ -21361,7 +21361,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -21471,7 +21471,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -21577,11 +21577,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-expression CVE, duration-only justification, library heavily loaded (91/142 classes)." + "value": "High severity, negligible EPSS; acceptable." } ] }, @@ -21687,11 +21687,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, negligible EPSS; acceptable." } ] }, @@ -21797,11 +21797,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, negligible EPSS; acceptable." } ] }, @@ -21911,7 +21911,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -22021,7 +22021,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -22131,7 +22131,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable despite EPSS 0.36." + "value": "Medium severity (despite EPSS 0.36); below the critical/high threshold the rubric targets." } ] }, @@ -22241,7 +22241,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -22351,7 +22351,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -22457,11 +22457,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-boot-autoconfigure CVE, duration-only justification, library well-loaded (195/848 classes)." + "value": "High severity, very low EPSS (0.01); acceptable." } ] }, @@ -22571,7 +22571,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -22677,11 +22677,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity hibernate-core CVE, duration-only justification, library heavily loaded (1563/3787 classes)." + "value": "High severity, low EPSS (0.03); acceptable." } ] }, @@ -22791,7 +22791,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -22897,11 +22897,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity hibernate-validator CVE, duration-only justification, library well-loaded (225/459 classes)." + "value": "High severity, negligible EPSS (0.0); acceptable." } ] }, @@ -23007,11 +23007,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity guava CVE, duration-only justification, though usage is minimal (5/1717 classes)." + "value": "High severity, negligible EPSS (0.0); acceptable, and library usage is minimal (5/1717 classes)." } ] }, @@ -23121,7 +23121,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, duration-based acceptance reasonable." + "value": "Low severity; acceptable." } ] }, @@ -23229,7 +23229,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes." + "value": "Unscored severity; low stakes." } ] }, @@ -23337,7 +23337,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes." + "value": "Unscored severity; low stakes." } ] }, @@ -23447,7 +23447,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -23557,7 +23557,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -23667,7 +23667,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -23775,7 +23775,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -23883,7 +23883,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -23991,7 +23991,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -24099,7 +24099,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -24207,7 +24207,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -24315,7 +24315,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -24423,7 +24423,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability (test-scope library)." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -24531,7 +24531,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "For commons-lang3: code_not_reachable, structural non-reachability." + "value": "code_not_reachable on commons-lang3 (0/152 classes), structural, safe to rely on." } ] }, @@ -24639,7 +24639,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "For commons-lang3: code_not_reachable, structural non-reachability." + "value": "code_not_reachable on commons-lang3 (0/152 classes), structural, safe to rely on." } ] }, @@ -24749,7 +24749,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -24859,7 +24859,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -24969,7 +24969,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -25079,7 +25079,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "For spring-context: medium severity, duration-based acceptance reasonable." + "value": "Medium severity on spring-context; acceptable." } ] }, @@ -25189,7 +25189,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, duration-based acceptance reasonable." + "value": "Low severity; acceptable." } ] }, @@ -25297,7 +25297,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -25405,7 +25405,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -25513,7 +25513,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural non-reachability." + "value": "code_not_reachable, structural, safe to rely on." } ] }, @@ -25623,7 +25623,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance reasonable." + "value": "Medium severity; acceptable." } ] }, @@ -25731,7 +25731,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes." + "value": "Unscored severity; low stakes." } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index fb1336f..b2ebd0d 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -373,7 +373,14 @@ private int writeAssessmentsToVex(String vexPath, List results) thro if (byCve == null || cveId == null || !byCve.containsKey(cveId)) continue; JsonObject assessment = byCve.get(cveId); - JsonArray properties = v.has("properties") ? v.getAsJsonArray("properties") : new JsonArray(); + JsonArray oldProperties = v.has("properties") ? v.getAsJsonArray("properties") : new JsonArray(); + JsonArray properties = new JsonArray(); + for (JsonElement propEl : oldProperties) { + String name = getString(propEl.getAsJsonObject(), "name", ""); + if (!"contrast:vexAdvisorAssessment".equals(name) && !"contrast:vexAdvisorRationale".equals(name)) { + properties.add(propEl); + } + } properties.add(propertyJson("contrast:vexAdvisorAssessment", getString(assessment, "assessment", "unknown"))); properties.add(propertyJson("contrast:vexAdvisorRationale", getString(assessment, "rationale", ""))); v.add("properties", properties); @@ -404,6 +411,20 @@ private String generateReport(List appResults, List entrie Map entriesByName = new LinkedHashMap<>(); for (AppEntry e : entries) entriesByName.put(e.name, e); + // One assessment lookup per (app, cve), built once - avoids re-deriving it per section below. + Map> assessmentsByApp = new LinkedHashMap<>(); + for (JsonObject r : appResults) { + String app = getString(r, "application", null); + if (app == null || !r.has("statements")) continue; + Map byCve = new LinkedHashMap<>(); + for (JsonElement el : r.getAsJsonArray("statements")) { + JsonObject s = el.getAsJsonObject(); + String cveId = getString(s, "cve_id", null); + if (cveId != null) byCve.put(cveId, s); + } + assessmentsByApp.put(app, byCve); + } + Map riskCounts = new LinkedHashMap<>(); Map riskByApp = new LinkedHashMap<>(); for (JsonObject r : appResults) { @@ -415,12 +436,29 @@ private String generateReport(List appResults, List entrie int totalApps = appResults.size(); int totalStatements = 0; - int needsReviewCount = 0; for (AppEntry e : entries) totalStatements += e.statements.size(); + + int needsReviewCount = 0; + List kevFlagged = new ArrayList<>(); + List highEpssFlagged = new ArrayList<>(); + for (AppEntry entry : entries) { + Map byCve = assessmentsByApp.getOrDefault(entry.name, Map.of()); + for (VexStatement s : entry.statements) { + JsonObject assessment = byCve.get(s.cveId); + boolean flagged = assessment != null && "needs_review".equals(getString(assessment, "assessment", "")); + if (flagged) { + needsReviewCount++; + if (Boolean.TRUE.equals(s.cisaKev)) kevFlagged.add(s); + else if (s.epssScore != null && s.epssScore >= 0.5) highEpssFlagged.add(s); + } + } + } + + List criticalOrHighApps = new ArrayList<>(); for (JsonObject r : appResults) { - if (!r.has("statements")) continue; - for (JsonElement el : r.getAsJsonArray("statements")) { - if ("needs_review".equals(getString(el.getAsJsonObject(), "assessment", ""))) needsReviewCount++; + String level = getString(r, "risk_level", "UNKNOWN"); + if ("CRITICAL".equals(level) || "HIGH".equals(level)) { + criticalOrHighApps.add(getString(r, "application", "Unknown")); } } @@ -429,20 +467,34 @@ private String generateReport(List appResults, List entrie sb.append("# Contrast VEX Advisor\n## Review of Automatically-Generated VEX Claims\n\n---\n\n"); sb.append("**Report Date:** ").append(reportDate).append("\n"); sb.append("**Assessment Type:** VEX Claim Soundness Review\n\n---\n\n"); - sb.append("## Executive Summary\n\n"); + sb.append("## Summary\n\n"); sb.append("This report reviews VEX (Vulnerability Exploitability eXchange) claims generated from Contrast ") .append("Security runtime library-usage and CVE Shield/Protect data. It does not re-derive whether a CVE ") .append("exists - it judges whether each `not_affected`/`in_triage` claim is well-supported enough to rely ") .append("on as-is, or whether a human should look at it first.\n\n"); - sb.append("**").append(totalApps).append("** application(s), **").append(totalStatements) - .append("** VEX statement(s) reviewed.\n\n"); + sb.append("**Coverage:** ").append(totalApps).append(" application(s), ").append(totalStatements) + .append(" VEX statement(s) reviewed.\n\n"); + sb.append("**Key Findings:**\n\n"); if (needsReviewCount > 0) { - sb.append("> **").append(needsReviewCount).append(" claim(s) flagged for human review** before relying on them.\n"); + sb.append("- **").append(needsReviewCount).append(" of ").append(totalStatements) + .append(" claim(s) flagged for human review** before relying on them.\n"); } else { - sb.append("> No claims were flagged for review - all VEX statements look well-supported as generated.\n"); + sb.append("- No claims were flagged for review - all VEX statements look well-supported as generated.\n"); + } + if (!kevFlagged.isEmpty()) { + sb.append("- **").append(kevFlagged.size()) + .append(" flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - ") + .append("actively exploited in the wild: ").append(formatCveList(kevFlagged, 6)).append(".\n"); + } + if (!highEpssFlagged.isEmpty()) { + sb.append("- **").append(highEpssFlagged.size()) + .append(" flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): ") + .append(formatCveList(highEpssFlagged, 6)).append(".\n"); + } + if (!criticalOrHighApps.isEmpty()) { + sb.append("- Application(s) rated CRITICAL/HIGH risk: ").append(String.join(", ", criticalOrHighApps)).append(".\n"); } - sb.append("\n### Applications\n\n| Application | Risk Level | Statements |\n|-------------|------------|------------|\n"); for (AppEntry e : entries) { sb.append("| ").append(e.name).append(" | ").append(riskByApp.getOrDefault(e.name, "UNKNOWN")) @@ -456,7 +508,7 @@ private String generateReport(List appResults, List entrie } } - sb.append("\n---\n\n## Application Review\n\n"); + sb.append("\n---\n\n## Application Detail\n\n"); List order = java.util.Arrays.asList("CRITICAL", "HIGH", "MEDIUM", "LOW", "SOUND", "UNKNOWN"); List sortedResults = new ArrayList<>(appResults); @@ -474,36 +526,44 @@ private String generateReport(List appResults, List entrie sb.append(getString(r, "application_description", "No description available.")).append("\n\n"); sb.append("**Risk Rationale:** ").append(getString(r, "risk_rationale", "Unknown")).append("\n\n"); sb.append("**Recommendation:** ").append(getString(r, "recommendation", "None")).append("\n\n"); - sb.append("#### VEX Statements\n\n"); - Map statementAssessments = new LinkedHashMap<>(); - if (r.has("statements")) { - for (JsonElement sEl : r.getAsJsonArray("statements")) { - JsonObject s = sEl.getAsJsonObject(); - statementAssessments.put(getString(s, "cve_id", ""), s); - } - } + Map statementAssessments = assessmentsByApp.getOrDefault(appName, Map.of()); if (entry != null) { - sb.append("| CVE | Library | Severity | State | Assessment |\n|-----|---------|----------|-------|------------|\n"); + List needsReview = new ArrayList<>(); + List sound = new ArrayList<>(); for (VexStatement s : entry.statements) { JsonObject assessment = statementAssessments.get(s.cveId); String assessLabel = assessment != null ? getString(assessment, "assessment", "unknown") : "unknown"; - sb.append("| ").append(s.cveId).append(" | `").append(s.purl != null ? s.purl : "unknown") - .append("` | ").append(s.severity != null ? s.severity : "unknown").append(" | ") - .append(s.state).append(" | ").append(assessLabel).append(" |\n"); + if ("needs_review".equals(assessLabel)) needsReview.add(s); + else sound.add(s); } - sb.append("\n"); - for (VexStatement s : entry.statements) { - JsonObject assessment = statementAssessments.get(s.cveId); - if (assessment == null) continue; - String rationale = getString(assessment, "rationale", null); - if (rationale == null || rationale.isEmpty()) continue; - sb.append("- **").append(s.cveId).append("** (").append(getString(assessment, "assessment", "unknown")) - .append("): ").append(rationale).append("\n"); + if (!needsReview.isEmpty()) { + sb.append("#### Needs Review (").append(needsReview.size()).append(")\n\n"); + sb.append("| CVE | Library | Severity | State | Rationale |\n|-----|---------|----------|-------|-----------|\n"); + for (VexStatement s : needsReview) { + JsonObject assessment = statementAssessments.get(s.cveId); + String rationale = assessment != null ? getString(assessment, "rationale", "") : ""; + sb.append("| ").append(s.cveId).append(" | `").append(s.purl != null ? s.purl : "unknown") + .append("` | ").append(s.severity != null ? s.severity : "unknown").append(" | ") + .append(s.state).append(" | ").append(rationale.replace("|", "\\|")).append(" |\n"); + } + sb.append("\n"); + } + + if (!sound.isEmpty()) { + sb.append("#### Sound (").append(sound.size()).append(")\n\n"); + sb.append("
").append(sound.size()) + .append(" claim(s) assessed as sound as-is - expand for the full list\n\n"); + sb.append("| CVE | Library | Severity | State |\n|-----|---------|----------|-------|\n"); + for (VexStatement s : sound) { + sb.append("| ").append(s.cveId).append(" | `").append(s.purl != null ? s.purl : "unknown") + .append("` | ").append(s.severity != null ? s.severity : "unknown").append(" | ") + .append(s.state).append(" |\n"); + } + sb.append("\n
\n\n"); } - sb.append("\n"); } sb.append("---\n\n"); @@ -521,4 +581,20 @@ private String generateReport(List appResults, List entrie return sb.toString(); } + + private String formatCveList(List statements, int max) { + List distinctCves = new ArrayList<>(new java.util.LinkedHashSet<>( + statements.stream().map(s -> s.cveId).collect(java.util.stream.Collectors.toList()))); + StringBuilder sb = new StringBuilder(); + int shown = Math.min(distinctCves.size(), max); + for (int i = 0; i < shown; i++) { + if (i > 0) sb.append(", "); + sb.append(distinctCves.get(i)); + } + if (distinctCves.size() > max) { + sb.append(" (+").append(distinctCves.size() - max).append(" more)"); + } + return sb.toString(); + } + } From a6e30fe092d1e74550d1f27c7a660dedebd5de12 Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 20:13:33 -0400 Subject: [PATCH 06/16] Merge VEX Advisor's per-app tables into one compressed table with coded rationale Replaces the separate Needs Review / Sound tables with a single table per app: CVE | Library | Score | VEX | Rationale. Narrower on every axis: - Library is "artifact@version" (e.g. jackson-databind@2.8.8) instead of the full backtick-quoted purl - Severity text (critical/high/...) replaced with the numeric CVSS score - State abbreviated to NA/IT - Rationale is a 3-letter code instead of a full-sentence AI rationale repeated per row: UNU (code_not_reachable), SHD (protected_at_runtime), AGD (duration-based not_affected), WCH (in_triage) - with a `!` suffix when the VEX Advisor flagged that specific claim needs_review A Legend section (once, before the per-app tables) decodes all of it. Flagged rows sort to the top of each table, by severity, so the claims that matter are visible without scanning 235 rows. The per-row rationale sentence is gone from the table entirely - the app-level Risk Rationale/ Recommendation paragraphs already explain what's driving the flags. Regenerated samples/sample-vex.json and sample-vex-advisor.md against SAML-PetClinic-Demo. --- README.md | 2 +- samples/sample-vex-advisor.md | 517 +++++++-------- samples/sample-vex.json | 600 +++++++++--------- .../runtimeanalyst/VEXAdvisor.java | 91 +-- 4 files changed, 616 insertions(+), 594 deletions(-) diff --git a/README.md b/README.md index efdf37d..63c9e6b 100644 --- a/README.md +++ b/README.md @@ -221,7 +221,7 @@ Note: `PROTECTED_AT_RUNTIME` (CVE Shield/Protect actively mitigating) is impleme - **Quantum Advisor** - findings grouped by risk level (CRITICAL/HIGH/MEDIUM/LOW/NOT_QUANTUM_ISSUE), with an "Application Context" section describing each app from its architecture graph data - **AI Advisor** - organized as an inventory of AI-enabled applications (one section per app, not per finding): an AI-generated description of what the app does, then each AI usage instance with model/provider/endpoint and a description of what that specific call is doing, inferred from the key methods around it in the stack trace -- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. Organized one section per application, with a per-CVE table plus rationale for anything flagged. +- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Rationale`) using short codes - `UNU`/`SHD`/`AGD`/`WCH` plus a `!` suffix for `needs_review` - decoded in a legend, rather than a full-sentence rationale repeated per claim. Both the Quantum and AI Advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component. The VEX Advisor writes `contrast:vexAdvisorAssessment` (`sound`/`needs_review`) and `contrast:vexAdvisorRationale` back onto each vulnerability's `properties[]`. All of this happens automatically as part of every `--analyze` run, no separate step needed. diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index 42b87d8..52120ab 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -18,7 +18,7 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated **Key Findings:** -- **61 of 235 claim(s) flagged for human review** before relying on them. +- **125 of 235 claim(s) flagged for human review** before relying on them. - **8 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. - **10 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+4 more). - Application(s) rated CRITICAL/HIGH risk: SAML-PetClinic-Demo. @@ -27,283 +27,286 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated | Application | Risk Level | Statements | |-------------|------------|------------| -| SAML-PetClinic-Demo | HIGH | 235 | +| SAML-PetClinic-Demo | CRITICAL | 235 | | Risk Level | Applications | |------------|--------------| -| HIGH | 1 | +| CRITICAL | 1 | ---- - -## Application Detail +### Legend -### SAML-PetClinic-Demo +**VEX** - `NA` = not_affected, `IT` = in_triage -**Risk Level:** HIGH +**Rationale code:** -SAML-PetClinic-Demo carries roughly 210 VEX claims across ~40 outdated libraries (jackson-databind 2.8.8, tomcat-embed-core 8.5.15, spring-web/webmvc/beans 4.3.9, snakeyaml 1.17, netty 3.5.7, plexus-utils 3.0.8, etc.), almost all `not_affected`. A meaningful minority are backed by `code_not_reachable` (zero classes loaded) and are structurally sound; the majority instead rely on 288 days of non-execution as the sole justification, and a large number of those cover critical/high-severity or KEV-listed CVEs. +| Code | Meaning | +|------|---------| +| `UNU` | Unused - library never loaded at runtime (0 classes) | +| `SHD` | Shielded - CVE Shield/Protect actively mitigating at runtime | +| `AGD` | Aged out - not_affected on duration alone (no observed execution past the acceptance threshold) | +| `WCH` | Watching - in_triage, still within the acceptance window | +| `!` suffix | Flagged `needs_review` by the VEX Advisor - see the app's Risk Rationale above | -**Risk Rationale:** The 288-day observation window comfortably clears the 30-day policy threshold, so duration alone isn't the problem. The problem is scale and severity: dozens of critical-severity jackson-databind CVEs, four instances of the KEV-listed Spring4Shell CVE-2022-22965 (three of which rely on duration-only reasoning rather than code_not_reachable), KEV-listed Tomcat Ghostcat/CVE-2020-1938, CVE-2017-12617, CVE-2025-24813, and CVE-2023-44487, plus KEV-listed spring-data-commons CVE-2018-1273 (EPSS 0.97) are all accepted purely on 'no observed execution' rather than structural non-reachability. Given the number and severity of these, this VEX set should not be trusted at face value for its critical/KEV entries. +--- -**Recommendation:** Prioritize human review of: all four spring-beans/spring-webmvc/spring-web instances tied to CVE-2022-22965 (data-binding RCE, KEV), spring-data-commons CVE-2018-1273 (KEV, EPSS 0.97), the KEV-listed tomcat-embed-core CVEs (CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487), and the ~24 critical-severity jackson-databind CVEs on 2.8.8. For these, verify with a manual reachability/pen-test check or accept the library upgrade instead of the VEX claim. The `code_not_reachable` claims (htmlunit, snakeyaml, netty, plexus-utils, jetty-http, bootstrap, junit, commons-lang/-lang3, commons-compress, neko-htmlunit, commons-io, httpclient, spring-boot-starter-web/-actuator) can be relied on as-is. +## Application Detail -#### Needs Review (61) +### SAML-PetClinic-Demo -| CVE | Library | Severity | State | Rationale | -|-----|---------|----------|-------|-----------| -| CVE-2018-14721 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (10.0) accepted solely on 288 days of non-execution with no structural non-reachability; jackson-databind deserialization CVEs of this class are historically found reachable unexpectedly. | -| CVE-2018-11307 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted on duration alone; no code_not_reachable backing. | -| CVE-2017-17485 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) with elevated EPSS (0.5, 98.8th pct) accepted purely on non-execution duration; warrants a closer look. | -| CVE-2020-8840 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8), EPSS 0.27, duration-only justification - worth a manual check. | -| CVE-2019-16335 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2019-20330 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2018-14718 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2018-14720 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2018-14719 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2020-9548 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2019-14540 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2020-9547 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2019-14892 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2019-16942 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2018-19361 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2019-16943 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2018-19360 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2018-19362 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2019-17267 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2017-7525 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8), EPSS 0.38, duration-only - the well-known jackson polymorphic-deserialization gadget class, worth verifying. | -| CVE-2018-7489 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8), EPSS 0.2, accepted solely on non-execution duration. | -| CVE-2019-17531 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2017-15095 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2019-14379 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration. | -| CVE-2020-36179 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | High severity with EPSS 0.21 (97th pct) accepted on duration alone; worth a closer look. | -| CVE-2020-25649 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | High severity with EPSS 0.18 (97th pct) accepted purely on duration; worth verifying. | -| CVE-2019-12086 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | High severity with EPSS 0.22 (97th pct) accepted purely on non-execution duration; worth verifying. | -| CVE-2020-10683 | `pkg:maven/dom4j/dom4j@1.6.1` | critical | not_affected | Critical (9.8) dom4j XXE, only 1 of 190 classes ever used, but that one class is loaded and the claim relies purely on non-execution duration - worth confirming that class isn't the vulnerable entry point. | -| CVE-2022-22965 | `pkg:maven/org.springframework.boot/spring-boot-starter-web@1.5.4.RELEASE` | critical | not_affected | KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review. | -| CVE-2018-1273 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | critical | not_affected | KEV-listed, critical (9.8), EPSS 0.97 (99.9th pct) - one of the most exploitable CVEs in this VEX set, yet accepted purely on non-execution duration. Requires explicit human verification, not automated acceptance. | -| CVE-2022-41853 | `pkg:maven/org.hsqldb/hsqldb@2.3.5` | critical | not_affected | Critical (9.8) accepted solely on non-execution duration despite substantial hsqldb usage (229/601 classes) - worth confirming. | -| CVE-2017-5929 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | critical | not_affected | Critical (9.8) on logback-classic, same underlying gap as the logback-core instance: accepted purely on non-execution duration. | -| CVE-2016-1000027 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | critical | not_affected | Critical (9.8) spring-web deserialization CVE accepted solely on non-execution duration despite meaningful library usage (211/559 classes); worth verifying. | -| CVE-2022-22965 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | critical | not_affected | KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review. | -| CVE-2024-38819 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | high | not_affected | High severity with elevated EPSS (0.55, 99th pct) accepted purely on non-execution duration; worth verifying. | -| CVE-2017-5929 | `pkg:maven/ch.qos.logback/logback-classic@1.1.11` | critical | not_affected | Critical (9.8) on logback-classic, same underlying gap as the logback-core instance: accepted purely on non-execution duration. | -| CVE-2022-22965 | `pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE` | critical | not_affected | KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review. | -| CVE-2018-8014 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | Critical (9.8) on heavily-used tomcat-embed-core (387/1481 classes), accepted purely on non-execution duration. | -| CVE-2025-24813 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | KEV-listed, critical (9.8), EPSS 1.0 - among the most exploitable CVEs in this set, accepted purely on duration; requires human verification. | -| CVE-2026-43512 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | Critical (9.8) accepted purely on non-execution duration on a heavily-loaded library. | -| CVE-2020-1938 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | KEV-listed (Ghostcat), critical (9.8), EPSS 0.99 - requires human verification rather than duration-only acceptance. | -| CVE-2025-31651 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | Critical (9.8) accepted purely on non-execution duration. | -| CVE-2024-50379 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | Critical (9.8), EPSS 0.44, accepted purely on non-execution duration. | -| CVE-2026-43515 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | critical | not_affected | Critical (9.1) accepted purely on non-execution duration. | -| CVE-2019-0232 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity with EPSS 1.0 (near-certain exploitation observed elsewhere) accepted purely on non-execution duration. | -| CVE-2017-12617 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | KEV-listed, EPSS 1.0 - requires human verification rather than duration-only acceptance. | -| CVE-2019-0199 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.73, accepted purely on non-execution duration. | -| CVE-2018-8034 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.21, accepted purely on non-execution duration. | -| CVE-2025-55752 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.67, accepted purely on non-execution duration. | -| CVE-2019-10072 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.73, accepted purely on non-execution duration. | -| CVE-2021-25122 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.18, accepted purely on non-execution duration. | -| CVE-2025-48988 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.57, accepted purely on non-execution duration. | -| CVE-2025-31650 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.6, accepted purely on non-execution duration. | -| CVE-2024-24549 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.23, accepted purely on non-execution duration. | -| CVE-2023-44487 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | KEV-listed (HTTP/2 Rapid Reset), EPSS 1.0 - requires human verification rather than duration-only acceptance. | -| CVE-2018-1336 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.21, accepted purely on non-execution duration. | -| CVE-2020-9484 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | High severity, EPSS 0.57, accepted purely on non-execution duration. | -| CVE-2026-41901 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | Critical (9.0) thymeleaf CVE accepted solely on non-execution duration despite substantial library usage (367/549 classes); worth verifying. | -| CVE-2026-40477 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | Critical (9.0) accepted solely on non-execution duration. | -| CVE-2026-40478 | `pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE` | critical | not_affected | Critical (9.0) accepted solely on non-execution duration. | -| CVE-2022-34169 | `pkg:maven/xalan/xalan@2.7.2` | high | not_affected | High severity with very high EPSS (0.81, 99.6th pct) accepted purely on non-execution duration despite the library being loaded (7/1501 classes) - worth verifying given the strong exploitability signal. | +**Risk Level:** CRITICAL -#### Sound (174) +SAML-PetClinic-Demo has 235 VEX claims across roughly 40 libraries, most on jackson-databind 2.8.8, tomcat-embed-core 8.5.15, and the Spring 4.3.9/1.5.4 stack. About a third of claims rest on solid code_not_reachable (zero classes loaded) evidence and are safe to trust as-is; the rest, covering dozens of critical/high CVEs including three separate Spring4Shell (CVE-2022-22965) instances and Tomcat Ghostcat/rapid-reset KEV entries, are accepted purely on 288 days of no observed execution in a library that is otherwise heavily loaded and used. -
174 claim(s) assessed as sound as-is - expand for the full list +**Risk Rationale:** Several KEV-listed, high-EPSS critical CVEs (CVE-2022-22965 Spring4Shell across spring-data-commons/spring-webmvc/spring-beans, CVE-2020-1938 Ghostcat, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487) are marked not_affected using only duration-based absence-of-execution reasoning on libraries that are substantially loaded (100-1500+ classes in use), not structurally unreachable. Combined with the huge number of critical/high jackson-databind CVEs accepted the same way on a library with 263 of 582 classes actively used, this VEX set is not safe to rely on wholesale without human reachability verification on the flagged items. -| CVE | Library | Severity | State | -|-----|---------|----------|-------| -| CVE-2020-10673 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-35728 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-35491 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-35490 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36184 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36182 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36180 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36186 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36181 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-10650 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36185 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36188 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36187 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36189 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36183 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2021-20190 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2018-5968 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-24616 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-24750 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2022-42004 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2022-42003 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2018-12023 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2020-36518 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2019-14439 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2018-12022 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | high | not_affected | -| CVE-2019-12384 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | medium | not_affected | -| CVE-2019-12814 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8` | medium | not_affected | -| CVE-2023-26119 | `pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21` | critical | not_affected | -| CVE-2020-5529 | `pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21` | high | not_affected | -| CVE-2018-1000632 | `pkg:maven/dom4j/dom4j@1.6.1` | high | not_affected | -| CVE-2022-1471 | `pkg:maven/org.yaml/snakeyaml@1.17` | critical | not_affected | -| CVE-2022-25857 | `pkg:maven/org.yaml/snakeyaml@1.17` | high | not_affected | -| CVE-2017-18640 | `pkg:maven/org.yaml/snakeyaml@1.17` | high | not_affected | -| CVE-2022-38749 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | -| CVE-2022-41854 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | -| CVE-2022-38751 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | -| CVE-2022-38752 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | -| CVE-2022-38750 | `pkg:maven/org.yaml/snakeyaml@1.17` | medium | not_affected | -| CVE-2018-1274 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | high | not_affected | -| CVE-2026-41716 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | high | not_affected | -| CVE-2026-41721 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | medium | not_affected | -| CVE-2026-41711 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | medium | not_affected | -| CVE-2018-1259 | `pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE` | unknown | not_affected | -| CVE-2023-6378 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | high | not_affected | -| CVE-2021-42550 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | medium | not_affected | -| CVE-2026-10532 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | -| CVE-2026-1225 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | -| CVE-2026-9828 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | -| CVE-2025-11226 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | -| CVE-2024-12798 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | -| CVE-2024-12801 | `pkg:maven/ch.qos.logback/logback-core@1.1.11` | unknown | not_affected | -| CVE-2024-22243 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | -| CVE-2024-22262 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | -| CVE-2024-22259 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | high | not_affected | -| CVE-2018-11039 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | -| CVE-2024-38820 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | -| CVE-2024-38809 | `pkg:maven/org.springframework/spring-web@4.3.9.RELEASE` | medium | not_affected | -| CVE-2026-41842 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | high | not_affected | -| CVE-2026-41845 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | -| CVE-2026-41846 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | -| CVE-2026-41844 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | -| CVE-2026-41841 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | -| CVE-2026-41843 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | -| CVE-2026-22745 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | -| CVE-2026-41853 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | medium | not_affected | -| CVE-2026-22741 | `pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE` | low | not_affected | -| CVE-2023-6378 | `pkg:maven/ch.qos.logback/logback-classic@1.1.11` | high | not_affected | -| CVE-2022-22970 | `pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE` | medium | not_affected | -| CVE-2019-17563 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2023-46589 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2026-41284 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2026-43513 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2024-34750 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2025-49125 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2025-52434 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2022-42252 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2025-53506 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2025-52520 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2025-46701 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2019-12418 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2021-25329 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | high | not_affected | -| CVE-2018-1305 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | -| CVE-2019-0221 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | -| CVE-2021-24122 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | -| CVE-2018-8037 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | -| CVE-2018-1304 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | -| CVE-2025-61795 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | -| CVE-2024-21733 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | -| CVE-2023-42795 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | -| CVE-2018-11784 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15` | medium | not_affected | -| CVE-2017-1000487 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | critical | not_affected | -| CVE-2025-67030 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | high | not_affected | -| CVE-2022-4244 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | high | not_affected | -| CVE-2022-4245 | `pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8` | medium | not_affected | -| CVE-2019-20445 | `pkg:maven/io.netty/netty@3.5.7.Final` | critical | not_affected | -| CVE-2019-20444 | `pkg:maven/io.netty/netty@3.5.7.Final` | critical | not_affected | -| CVE-2021-37136 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | -| CVE-2021-37137 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | -| CVE-2019-16869 | `pkg:maven/io.netty/netty@3.5.7.Final` | high | not_affected | -| CVE-2021-43797 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | -| CVE-2021-21409 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | -| CVE-2021-21295 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | -| CVE-2021-21290 | `pkg:maven/io.netty/netty@3.5.7.Final` | medium | not_affected | -| CVE-2015-2156 | `pkg:maven/io.netty/netty@3.5.7.Final` | unknown | not_affected | -| CVE-2026-2332 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | critical | not_affected | -| CVE-2025-11143 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | -| CVE-2024-6763 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | -| CVE-2023-40167 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | medium | not_affected | -| CVE-2022-2047 | `pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502` | low | not_affected | -| CVE-2018-3258 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | high | not_affected | -| CVE-2023-22102 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | high | not_affected | -| CVE-2019-2692 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | medium | not_affected | -| CVE-2022-21363 | `pkg:maven/mysql/mysql-connector-java@5.1.42` | unknown | not_affected | -| CVE-2026-22733 | `pkg:maven/org.springframework.boot/spring-boot-starter-actuator@1.5.4.RELEASE` | high | not_affected | -| CVE-2022-27772 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | -| CVE-2025-22235 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | -| CVE-2026-40973 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | high | not_affected | -| CVE-2018-1196 | `pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE` | medium | not_affected | -| CVE-2022-28366 | `pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21` | high | not_affected | -| CVE-2022-29546 | `pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21` | high | not_affected | -| CVE-2022-25647 | `pkg:maven/com.google.code.gson/gson@2.8.0` | high | not_affected | -| CVE-2021-36090 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | -| CVE-2021-35516 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | -| CVE-2021-35517 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | -| CVE-2021-35515 | `pkg:maven/org.apache.commons/commons-compress@1.9` | high | not_affected | -| CVE-2024-25710 | `pkg:maven/org.apache.commons/commons-compress@1.9` | medium | not_affected | -| CVE-2018-11771 | `pkg:maven/org.apache.commons/commons-compress@1.9` | medium | not_affected | -| CVE-2018-1272 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | -| CVE-2018-15756 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | -| CVE-2026-41848 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | -| CVE-2018-11040 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | high | not_affected | -| CVE-2018-1257 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | -| CVE-2018-1271 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | -| CVE-2018-1199 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | -| CVE-2021-22096 | `pkg:maven/org.springframework/spring-core@4.3.9.RELEASE` | medium | not_affected | -| CVE-2026-41850 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | -| CVE-2026-41851 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | -| CVE-2026-41849 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | high | not_affected | -| CVE-2023-20863 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | -| CVE-2023-20861 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | -| CVE-2022-22950 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | -| CVE-2026-41852 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | -| CVE-2024-38808 | `pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE` | medium | not_affected | -| CVE-2023-20883 | `pkg:maven/org.springframework.boot/spring-boot-autoconfigure@1.5.4.RELEASE` | high | not_affected | -| CVE-2024-23672 | `pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15` | medium | not_affected | -| CVE-2020-25638 | `pkg:maven/org.hibernate/hibernate-core@5.0.4.Final` | high | not_affected | -| CVE-2019-14900 | `pkg:maven/org.hibernate/hibernate-core@5.0.4.Final` | medium | not_affected | -| CVE-2017-7536 | `pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final` | high | not_affected | -| CVE-2023-2976 | `pkg:maven/com.google.guava/guava@19.0` | high | not_affected | -| CVE-2020-8908 | `pkg:maven/com.google.guava/guava@19.0` | low | not_affected | -| CVE-2012-0881 | `pkg:maven/xerces/xercesimpl@2.11.0` | unknown | not_affected | -| CVE-2013-4002 | `pkg:maven/xerces/xercesimpl@2.11.0` | unknown | not_affected | -| CVE-2022-23437 | `pkg:maven/xerces/xercesimpl@2.11.0` | medium | not_affected | -| CVE-2020-14338 | `pkg:maven/xerces/xercesimpl@2.11.0` | medium | not_affected | -| CVE-2023-34055 | `pkg:maven/org.springframework.boot/spring-boot-actuator@1.5.4.RELEASE` | medium | not_affected | -| CVE-2018-14042 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | -| CVE-2018-14040 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | -| CVE-2016-10735 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | -| CVE-2019-8331 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | -| CVE-2018-20677 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | -| CVE-2018-20676 | `pkg:maven/org.webjars/bootstrap@3.3.6` | medium | not_affected | -| CVE-2020-15250 | `pkg:maven/junit/junit@4.12` | medium | not_affected | -| CVE-2025-48924 | `pkg:maven/commons-lang/commons-lang@2.6` | medium | not_affected | -| CVE-2025-48924 | `pkg:maven/org.apache.commons/commons-lang3@3.1` | medium | not_affected | -| CVE-2019-3797 | `pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE` | medium | not_affected | -| CVE-2019-3802 | `pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE` | medium | not_affected | -| CVE-2022-22968 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | medium | not_affected | -| CVE-2024-38820 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | medium | not_affected | -| CVE-2025-22233 | `pkg:maven/org.springframework/spring-context@4.3.9.RELEASE` | low | not_affected | -| CVE-2020-13956 | `pkg:maven/org.apache.httpcomponents/httpclient@4.5.3` | medium | not_affected | -| CVE-2021-29425 | `pkg:maven/commons-io/commons-io@2.4` | medium | not_affected | -| CVE-2024-47554 | `pkg:maven/commons-io/commons-io@2.4` | medium | not_affected | -| CVE-2025-49128 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8` | medium | not_affected | -| CVE-2025-52999 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8` | unknown | not_affected | +**Recommendation:** Prioritize manual review of the KEV/high-EPSS duration-only claims first: CVE-2022-22965 (spring-data-commons, spring-webmvc, spring-beans), CVE-2020-1938 and CVE-2017-12617 and CVE-2023-44487 and CVE-2025-24813 (tomcat-embed-core), and CVE-2018-1273 (spring-data-commons). Then work through the remaining critical/high jackson-databind, tomcat-embed-core, spring-web/-core/-expression, dom4j, hsqldb, logback, thymeleaf, mysql-connector-java, hibernate, guava, gson, and xalan claims flagged needs_review, ideally by confirming route-level reachability rather than relying on elapsed-time-without-execution. The code_not_reachable claims (snakeyaml, netty, jetty-http, plexus-utils, commons-compress, bootstrap, junit, commons-lang/-lang3, commons-io, httpclient, neko-htmlunit, htmlunit, spring-boot-starter-web/-actuator) can be trusted as-is. -
+| CVE | Library | Score | VEX | Rationale | +|-----|---------|-------|-----|-----------| +| CVE-2018-14721 | jackson-databind@2.8.8 | 10.0 | NA | AGD! | +| CVE-2018-11307 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2017-17485 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2019-20330 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2018-14718 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2018-14719 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2020-9548 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2019-14540 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2020-9547 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2019-14892 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2018-19361 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2018-19360 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2018-19362 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2019-17267 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2017-7525 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2018-7489 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2019-17531 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | +| CVE-2020-10683 | dom4j@1.6.1 | 9.8 | NA | AGD! | +| CVE-2022-22965 | spring-boot-starter-web@1.5.4.RELEASE | 9.8 | NA | UNU! | +| CVE-2018-1273 | spring-data-commons@1.13.4.RELEASE | 9.8 | NA | AGD! | +| CVE-2022-41853 | hsqldb@2.3.5 | 9.8 | NA | AGD! | +| CVE-2017-5929 | logback-core@1.1.11 | 9.8 | NA | AGD! | +| CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | AGD! | +| CVE-2022-22965 | spring-webmvc@4.3.9.RELEASE | 9.8 | NA | AGD! | +| CVE-2017-5929 | logback-classic@1.1.11 | 9.8 | NA | AGD! | +| CVE-2022-22965 | spring-beans@4.3.9.RELEASE | 9.8 | NA | AGD! | +| CVE-2018-8014 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | +| CVE-2025-24813 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | +| CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | +| CVE-2020-1938 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | +| CVE-2025-31651 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | +| CVE-2024-50379 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | +| CVE-2026-43515 | tomcat-embed-core@8.5.15 | 9.1 | NA | AGD! | +| CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | AGD! | +| CVE-2026-40477 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | AGD! | +| CVE-2026-40478 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | AGD! | +| CVE-2020-10673 | jackson-databind@2.8.8 | 8.8 | NA | AGD! | +| CVE-2020-35728 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-35491 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-35490 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36184 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36182 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36180 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36186 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36181 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36179 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-10650 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36185 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36188 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36187 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36189 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-36183 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2021-20190 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2018-5968 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-24616 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2020-24750 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | +| CVE-2022-42004 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | +| CVE-2022-42003 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | +| CVE-2020-25649 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | +| CVE-2018-12023 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | +| CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | +| CVE-2019-14439 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | +| CVE-2018-12022 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | +| CVE-2019-12086 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | +| CVE-2018-1000632 | dom4j@1.6.1 | 7.5 | NA | AGD! | +| CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | AGD! | +| CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | AGD! | +| CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | AGD! | +| CVE-2024-22243 | spring-web@4.3.9.RELEASE | 8.1 | NA | AGD! | +| CVE-2024-22262 | spring-web@4.3.9.RELEASE | 8.1 | NA | AGD! | +| CVE-2024-22259 | spring-web@4.3.9.RELEASE | 8.1 | NA | AGD! | +| CVE-2026-41842 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | AGD! | +| CVE-2024-38819 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | AGD! | +| CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | AGD! | +| CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | AGD! | +| CVE-2017-12617 | tomcat-embed-core@8.5.15 | 8.1 | NA | AGD! | +| CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2018-8034 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2019-17563 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2023-46589 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2025-55752 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2026-43513 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2021-25122 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2025-48988 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2025-49125 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2025-53506 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2025-52520 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2025-31650 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2023-44487 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2018-1336 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | +| CVE-2025-46701 | tomcat-embed-core@8.5.15 | 7.3 | NA | AGD! | +| CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | AGD! | +| CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | AGD! | +| CVE-2020-9484 | tomcat-embed-core@8.5.15 | 7.0 | NA | AGD! | +| CVE-2018-3258 | mysql-connector-java@5.1.42 | 8.8 | NA | AGD! | +| CVE-2023-22102 | mysql-connector-java@5.1.42 | 8.3 | NA | AGD! | +| CVE-2022-27772 | spring-boot@1.5.4.RELEASE | 7.8 | NA | AGD! | +| CVE-2025-22235 | spring-boot@1.5.4.RELEASE | 7.3 | NA | AGD! | +| CVE-2026-40973 | spring-boot@1.5.4.RELEASE | 7.0 | NA | AGD! | +| CVE-2022-25647 | gson@2.8.0 | 7.5 | NA | AGD! | +| CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | AGD! | +| CVE-2018-1272 | spring-core@4.3.9.RELEASE | 7.5 | NA | AGD! | +| CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | AGD! | +| CVE-2026-41848 | spring-core@4.3.9.RELEASE | 7.5 | NA | AGD! | +| CVE-2018-11040 | spring-core@4.3.9.RELEASE | 7.5 | NA | AGD! | +| CVE-2026-41850 | spring-expression@4.3.9.RELEASE | 7.5 | NA | AGD! | +| CVE-2026-41851 | spring-expression@4.3.9.RELEASE | 7.5 | NA | AGD! | +| CVE-2026-41849 | spring-expression@4.3.9.RELEASE | 7.5 | NA | AGD! | +| CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | AGD! | +| CVE-2020-25638 | hibernate-core@5.0.4.Final | 7.4 | NA | AGD! | +| CVE-2017-7536 | hibernate-validator@5.3.5.Final | 7.0 | NA | AGD! | +| CVE-2023-2976 | guava@19.0 | 7.1 | NA | AGD! | +| CVE-2023-26119 | htmlunit@2.21 | 9.8 | NA | UNU | +| CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | UNU | +| CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | UNU | +| CVE-2019-20445 | netty@3.5.7.Final | 9.1 | NA | UNU | +| CVE-2019-20444 | netty@3.5.7.Final | 9.1 | NA | UNU | +| CVE-2026-2332 | jetty-http@9.4.5.v20170502 | 9.1 | NA | UNU | +| CVE-2020-5529 | htmlunit@2.21 | 8.1 | NA | UNU | +| CVE-2022-25857 | snakeyaml@1.17 | 7.5 | NA | UNU | +| CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | UNU | +| CVE-2025-67030 | plexus-utils@3.0.8 | 8.8 | NA | UNU | +| CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | UNU | +| CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | UNU | +| CVE-2021-37137 | netty@3.5.7.Final | 7.5 | NA | UNU | +| CVE-2019-16869 | netty@3.5.7.Final | 7.5 | NA | UNU | +| CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | UNU | +| CVE-2022-28366 | neko-htmlunit@2.21 | 7.5 | NA | UNU | +| CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | UNU | +| CVE-2021-36090 | commons-compress@1.9 | 7.5 | NA | UNU | +| CVE-2021-35516 | commons-compress@1.9 | 7.5 | NA | UNU | +| CVE-2021-35517 | commons-compress@1.9 | 7.5 | NA | UNU | +| CVE-2021-35515 | commons-compress@1.9 | 7.5 | NA | UNU | +| CVE-2019-12384 | jackson-databind@2.8.8 | 5.9 | NA | AGD | +| CVE-2019-12814 | jackson-databind@2.8.8 | 5.9 | NA | AGD | +| CVE-2022-38749 | snakeyaml@1.17 | 6.5 | NA | UNU | +| CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | UNU | +| CVE-2022-38751 | snakeyaml@1.17 | 6.5 | NA | UNU | +| CVE-2022-38752 | snakeyaml@1.17 | 6.5 | NA | UNU | +| CVE-2022-38750 | snakeyaml@1.17 | 5.5 | NA | UNU | +| CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | AGD | +| CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | AGD | +| CVE-2021-42550 | logback-core@1.1.11 | 6.6 | NA | AGD | +| CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | AGD | +| CVE-2024-38820 | spring-web@4.3.9.RELEASE | 5.3 | NA | AGD | +| CVE-2024-38809 | spring-web@4.3.9.RELEASE | 5.3 | NA | AGD | +| CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | AGD | +| CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | AGD | +| CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | AGD | +| CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | AGD | +| CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | AGD | +| CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | AGD | +| CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | AGD | +| CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | AGD | +| CVE-2018-1305 | tomcat-embed-core@8.5.15 | 6.5 | NA | AGD | +| CVE-2019-0221 | tomcat-embed-core@8.5.15 | 6.1 | NA | AGD | +| CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | AGD | +| CVE-2018-8037 | tomcat-embed-core@8.5.15 | 5.9 | NA | AGD | +| CVE-2018-1304 | tomcat-embed-core@8.5.15 | 5.9 | NA | AGD | +| CVE-2025-61795 | tomcat-embed-core@8.5.15 | 5.3 | NA | AGD | +| CVE-2024-21733 | tomcat-embed-core@8.5.15 | 5.3 | NA | AGD | +| CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | AGD | +| CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | AGD | +| CVE-2022-4245 | plexus-utils@3.0.8 | 4.3 | NA | UNU | +| CVE-2021-43797 | netty@3.5.7.Final | 6.5 | NA | UNU | +| CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | UNU | +| CVE-2021-21295 | netty@3.5.7.Final | 5.9 | NA | UNU | +| CVE-2021-21290 | netty@3.5.7.Final | 5.5 | NA | UNU | +| CVE-2025-11143 | jetty-http@9.4.5.v20170502 | 6.5 | NA | UNU | +| CVE-2024-6763 | jetty-http@9.4.5.v20170502 | 5.3 | NA | UNU | +| CVE-2023-40167 | jetty-http@9.4.5.v20170502 | 5.3 | NA | UNU | +| CVE-2019-2692 | mysql-connector-java@5.1.42 | 6.3 | NA | AGD | +| CVE-2018-1196 | spring-boot@1.5.4.RELEASE | 5.9 | NA | AGD | +| CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | UNU | +| CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | UNU | +| CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | AGD | +| CVE-2018-1271 | spring-core@4.3.9.RELEASE | 5.9 | NA | AGD | +| CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | AGD | +| CVE-2021-22096 | spring-core@4.3.9.RELEASE | 4.3 | NA | AGD | +| CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | AGD | +| CVE-2023-20861 | spring-expression@4.3.9.RELEASE | 6.5 | NA | AGD | +| CVE-2022-22950 | spring-expression@4.3.9.RELEASE | 6.5 | NA | AGD | +| CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | AGD | +| CVE-2024-38808 | spring-expression@4.3.9.RELEASE | 4.3 | NA | AGD | +| CVE-2024-23672 | tomcat-embed-websocket@8.5.15 | 6.3 | NA | AGD | +| CVE-2019-14900 | hibernate-core@5.0.4.Final | 6.5 | NA | AGD | +| CVE-2022-23437 | xercesimpl@2.11.0 | 6.5 | NA | AGD | +| CVE-2020-14338 | xercesimpl@2.11.0 | 5.3 | NA | AGD | +| CVE-2023-34055 | spring-boot-actuator@1.5.4.RELEASE | 6.5 | NA | AGD | +| CVE-2018-14042 | bootstrap@3.3.6 | 6.1 | NA | UNU | +| CVE-2018-14040 | bootstrap@3.3.6 | 6.1 | NA | UNU | +| CVE-2016-10735 | bootstrap@3.3.6 | 6.1 | NA | UNU | +| CVE-2019-8331 | bootstrap@3.3.6 | 6.1 | NA | UNU | +| CVE-2018-20677 | bootstrap@3.3.6 | 6.1 | NA | UNU | +| CVE-2018-20676 | bootstrap@3.3.6 | 6.1 | NA | UNU | +| CVE-2020-15250 | junit@4.12 | 5.5 | NA | UNU | +| CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | UNU | +| CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | UNU | +| CVE-2019-3797 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | AGD | +| CVE-2019-3802 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | AGD | +| CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | AGD | +| CVE-2024-38820 | spring-context@4.3.9.RELEASE | 5.3 | NA | AGD | +| CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | UNU | +| CVE-2021-29425 | commons-io@2.4 | 4.8 | NA | UNU | +| CVE-2024-47554 | commons-io@2.4 | 4.3 | NA | UNU | +| CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | AGD | +| CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | AGD | +| CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | UNU | +| CVE-2020-8908 | guava@19.0 | 3.3 | NA | AGD | +| CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | AGD | +| CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | AGD | +| CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | AGD | +| CVE-2026-1225 | logback-core@1.1.11 | 0.0 | NA | AGD | +| CVE-2026-9828 | logback-core@1.1.11 | 0.0 | NA | AGD | +| CVE-2025-11226 | logback-core@1.1.11 | 0.0 | NA | AGD | +| CVE-2024-12798 | logback-core@1.1.11 | 0.0 | NA | AGD | +| CVE-2024-12801 | logback-core@1.1.11 | 0.0 | NA | AGD | +| CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | UNU | +| CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | AGD | +| CVE-2012-0881 | xercesimpl@2.11.0 | 0.0 | NA | AGD | +| CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | AGD | +| CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | AGD | --- ## Appendix: Methodology -VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This advisor does not change any claim; it only assesses whether relying on each claim as generated is reasonable given the CVE's severity and exploitability. +VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This advisor does not change any claim; it only assesses whether relying on each claim as generated is reasonable given the CVE's severity and exploitability. See the Legend above for the VEX/Rationale codes used in the per-application tables. -- **sound**: the claim's justification (structural fact or active control) supports relying on it as-is -- **needs_review**: the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or is otherwise borderline - a human should confirm before treating it as resolved +- **sound** (no `!`): the claim's justification (structural fact or active control) supports relying on it as-is +- **needs_review** (`!` suffix): the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or is otherwise borderline - a human should confirm before treating it as resolved --- diff --git a/samples/sample-vex.json b/samples/sample-vex.json index 4068d9d..1123d75 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -3,7 +3,7 @@ "specVersion": "1.6", "version": 1, "metadata": { - "timestamp": "2026-09-02T22:10:38Z", + "timestamp": "2026-09-03T00:09:42Z", "component": { "type": "application", "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", @@ -117,7 +117,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (10.0) accepted solely on 288 days of non-execution with no structural non-reachability; jackson-databind deserialization CVEs of this class are historically found reachable unexpectedly." + "value": "Critical CVE (10.0) on jackson-databind accepted solely on 288 days without observed execution; the library is heavily loaded (263/582 classes) so absence-of-evidence is weak given the severity." } ] }, @@ -227,7 +227,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted on duration alone; no code_not_reachable backing." + "value": "Critical CVE accepted only on duration; library is substantially loaded, warrants reachability confirmation." } ] }, @@ -337,7 +337,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) with elevated EPSS (0.5, 98.8th pct) accepted purely on non-execution duration; warrants a closer look." + "value": "Critical CVE with elevated EPSS (0.5) accepted only on duration; should be verified rather than trusted on absence-of-execution alone." } ] }, @@ -447,7 +447,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8), EPSS 0.27, duration-only justification - worth a manual check." + "value": "Critical CVE accepted only on duration-based reasoning on a heavily loaded library." } ] }, @@ -557,7 +557,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration; not a structural non-reachability guarantee." } ] }, @@ -667,7 +667,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration; needs human reachability check." } ] }, @@ -777,7 +777,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -887,7 +887,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -997,7 +997,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -1107,7 +1107,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -1217,7 +1217,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -1327,7 +1327,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -1437,7 +1437,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -1547,7 +1547,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -1657,7 +1657,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -1767,7 +1767,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -1877,7 +1877,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -1987,7 +1987,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -2097,7 +2097,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -2207,7 +2207,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8), EPSS 0.38, duration-only - the well-known jackson polymorphic-deserialization gadget class, worth verifying." + "value": "Critical CVE with EPSS 0.38 accepted only on duration; deserves closer look given exploit interest." } ] }, @@ -2317,7 +2317,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8), EPSS 0.2, accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -2427,7 +2427,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -2537,7 +2537,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -2647,7 +2647,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration-based observation." } ] }, @@ -2753,11 +2753,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but low EPSS (0.08); 288 days is well past the 30-day threshold, acceptable to rely on." + "value": "High severity (8.8) jackson-databind CVE accepted only on duration; should be verified before trusting." } ] }, @@ -2863,11 +2863,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.13, duration comfortably exceeds threshold; reasonable to accept." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -2973,11 +2973,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.09); acceptable duration-based claim." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -3083,11 +3083,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.08); acceptable duration-based claim." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -3193,11 +3193,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.1); acceptable duration-based claim." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -3303,11 +3303,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -3413,11 +3413,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -3523,11 +3523,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -3633,11 +3633,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -3747,7 +3747,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.21 (97th pct) accepted on duration alone; worth a closer look." + "value": "High severity CVE with EPSS 0.21 accepted only on duration; worth confirming." } ] }, @@ -3853,11 +3853,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.03); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -3963,11 +3963,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -4073,11 +4073,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.11; acceptable given long observation window." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -4183,11 +4183,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -4293,11 +4293,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -4403,11 +4403,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -4513,11 +4513,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.07); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -4623,11 +4623,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.07); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -4733,11 +4733,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.09); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -4843,11 +4843,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.07); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -4953,11 +4953,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity (7.5), low EPSS (0.03); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -5063,11 +5063,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity (7.5), low EPSS (0.03); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -5177,7 +5177,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.18 (97th pct) accepted purely on duration; worth verifying." + "value": "High severity CVE with EPSS 0.18 accepted only on duration." } ] }, @@ -5283,11 +5283,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.09); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -5393,11 +5393,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -5503,11 +5503,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.11; acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -5613,11 +5613,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.07); acceptable." + "value": "High severity CVE accepted only on duration-based observation." } ] }, @@ -5727,7 +5727,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.22 (97th pct) accepted purely on non-execution duration; worth verifying." + "value": "High severity CVE with EPSS 0.22 accepted only on duration; worth confirming." } ] }, @@ -5837,7 +5837,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance is reasonable at this severity." + "value": "Medium severity; duration-based acceptance is reasonable given lower stakes." } ] }, @@ -5947,7 +5947,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance is reasonable at this severity." + "value": "Medium severity; duration-based acceptance is reasonable given lower stakes." } ] }, @@ -6055,7 +6055,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 1295 classes ever loaded - a structural fact, safe regardless of critical severity." + "value": "code_not_reachable with 0 of 1295 classes loaded is a structural fact, reliable regardless of critical severity." } ] }, @@ -6163,7 +6163,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded - structural, safe to rely on." + "value": "code_not_reachable, 0 classes loaded; structural fact, safe to rely on." } ] }, @@ -6273,7 +6273,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) dom4j XXE, only 1 of 190 classes ever used, but that one class is loaded and the claim relies purely on non-execution duration - worth confirming that class isn\u0027t the vulnerable entry point." + "value": "Critical CVE on dom4j accepted only on duration despite 1 class of the library being actively loaded." } ] }, @@ -6379,11 +6379,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but low EPSS (0.07); duration-based acceptance reasonable." + "value": "High severity CVE accepted only on duration on a library that is loaded (1 of 190 classes)." } ] }, @@ -6491,7 +6491,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable despite very high EPSS (1.0) - zero classes loaded is a structural fact independent of exploit prevalence." + "value": "code_not_reachable, 0 of 206 classes loaded; structural fact even though EPSS is maximal, safe as-is." } ] }, @@ -6599,7 +6599,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -6707,7 +6707,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -6815,7 +6815,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -6923,7 +6923,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -7031,7 +7031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -7139,7 +7139,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -7247,7 +7247,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -7355,7 +7355,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review." + "value": "On spring-beans, this is again Spring4Shell, KEV/EPSS 1.0, accepted only on duration on an actively used library (202/408 classes); needs verification." } ] }, @@ -7465,7 +7465,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed, critical (9.8), EPSS 0.97 (99.9th pct) - one of the most exploitable CVEs in this VEX set, yet accepted purely on non-execution duration. Requires explicit human verification, not automated acceptance." + "value": "Critical, KEV-listed CVE with EPSS 0.97 accepted only on duration on a library with 152 of 554 classes actively used; this is the type of claim that most needs verification before being relied on." } ] }, @@ -7571,11 +7571,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but low EPSS (0.02); acceptable given long observation." + "value": "High severity CVE accepted only on duration on the same actively-used spring-data-commons library." } ] }, @@ -7681,11 +7681,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS (0.0); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -7795,7 +7795,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -7905,7 +7905,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -8013,7 +8013,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored/unknown severity; low stakes." + "value": "Severity unscored/unknown; low stakes for duration-based acceptance." } ] }, @@ -8123,7 +8123,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted solely on non-execution duration despite substantial hsqldb usage (229/601 classes) - worth confirming." + "value": "Critical CVE on hsqldb accepted only on duration despite 229 of 601 classes actively loaded." } ] }, @@ -8233,7 +8233,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) on logback-classic, same underlying gap as the logback-core instance: accepted purely on non-execution duration." + "value": "On logback-classic, critical CVE accepted only on duration; library actively used (63/178 classes)." } ] }, @@ -8339,11 +8339,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but very low EPSS (0.01); acceptable." + "value": "On logback-classic, high severity CVE accepted only on duration." } ] }, @@ -8453,7 +8453,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -8561,7 +8561,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -8669,7 +8669,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -8777,7 +8777,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -8885,7 +8885,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -8993,7 +8993,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -9101,7 +9101,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -9211,7 +9211,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) spring-web deserialization CVE accepted solely on non-execution duration despite meaningful library usage (211/559 classes); worth verifying." + "value": "Critical CVE on spring-web accepted only on duration; EPSS 0.32 and library actively used (211/559 classes)." } ] }, @@ -9317,11 +9317,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.04); acceptable." + "value": "High severity CVE accepted only on duration on an actively used library." } ] }, @@ -9427,11 +9427,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.01); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -9537,11 +9537,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -9651,7 +9651,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -9761,7 +9761,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity on spring-context; acceptable." + "value": "Medium severity on spring-context; duration-based acceptance reasonable." } ] }, @@ -9871,7 +9871,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -9981,7 +9981,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review." + "value": "On spring-beans, this is again Spring4Shell, KEV/EPSS 1.0, accepted only on duration on an actively used library (202/408 classes); needs verification." } ] }, @@ -10087,11 +10087,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS (0.0); acceptable." + "value": "High severity CVE on spring-webmvc accepted only on duration." } ] }, @@ -10201,7 +10201,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.55, 99th pct) accepted purely on non-execution duration; worth verifying." + "value": "High severity CVE with elevated EPSS (0.55) accepted only on duration." } ] }, @@ -10311,7 +10311,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -10421,7 +10421,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -10531,7 +10531,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -10641,7 +10641,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -10751,7 +10751,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -10861,7 +10861,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -10971,7 +10971,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -11081,7 +11081,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; acceptable." + "value": "Low severity; duration-based acceptance reasonable." } ] }, @@ -11191,7 +11191,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) on logback-classic, same underlying gap as the logback-core instance: accepted purely on non-execution duration." + "value": "On logback-classic, critical CVE accepted only on duration; library actively used (63/178 classes)." } ] }, @@ -11297,11 +11297,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but very low EPSS (0.01); acceptable." + "value": "On logback-classic, high severity CVE accepted only on duration." } ] }, @@ -11411,7 +11411,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed Spring4Shell (EPSS 1.0) on spring-beans - library IS loaded (202/408 classes) and accepted purely on non-execution duration. High priority for manual review." + "value": "On spring-beans, this is again Spring4Shell, KEV/EPSS 1.0, accepted only on duration on an actively used library (202/408 classes); needs verification." } ] }, @@ -11521,7 +11521,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -11631,7 +11631,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) on heavily-used tomcat-embed-core (387/1481 classes), accepted purely on non-execution duration." + "value": "Critical CVE on tomcat-embed-core accepted only on duration; library heavily used (387/1481 classes)." } ] }, @@ -11741,7 +11741,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed, critical (9.8), EPSS 1.0 - among the most exploitable CVEs in this set, accepted purely on duration; requires human verification." + "value": "Critical, KEV-listed CVE with EPSS 1.0 accepted only on duration on heavily used tomcat-embed-core; top-priority claim to verify." } ] }, @@ -11851,7 +11851,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted purely on non-execution duration on a heavily-loaded library." + "value": "Critical CVE accepted only on duration." } ] }, @@ -11961,7 +11961,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed (Ghostcat), critical (9.8), EPSS 0.99 - requires human verification rather than duration-only acceptance." + "value": "Critical, KEV-listed \u0027Ghostcat\u0027 CVE with EPSS 0.99 accepted only on duration; needs manual verification." } ] }, @@ -12071,7 +12071,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) accepted purely on non-execution duration." + "value": "Critical CVE accepted only on duration." } ] }, @@ -12181,7 +12181,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8), EPSS 0.44, accepted purely on non-execution duration." + "value": "Critical CVE with elevated EPSS (0.44) accepted only on duration." } ] }, @@ -12291,7 +12291,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.1) accepted purely on non-execution duration." + "value": "Critical CVE accepted only on duration." } ] }, @@ -12401,7 +12401,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 1.0 (near-certain exploitation observed elsewhere) accepted purely on non-execution duration." + "value": "High severity CVE with EPSS 1.0 accepted only on duration." } ] }, @@ -12511,7 +12511,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed, EPSS 1.0 - requires human verification rather than duration-only acceptance." + "value": "High severity, KEV-listed CVE with EPSS 1.0 accepted only on duration; needs verification." } ] }, @@ -12621,7 +12621,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.73, accepted purely on non-execution duration." + "value": "High severity CVE with EPSS 0.73 accepted only on duration." } ] }, @@ -12731,7 +12731,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.21, accepted purely on non-execution duration." + "value": "High severity CVE accepted only on duration." } ] }, @@ -12837,11 +12837,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but EPSS below 0.15 (0.11); acceptable given long observation." + "value": "High severity CVE accepted only on duration." } ] }, @@ -12947,11 +12947,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -13061,7 +13061,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.67, accepted purely on non-execution duration." + "value": "High severity CVE with EPSS 0.67 accepted only on duration." } ] }, @@ -13167,11 +13167,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.01); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -13281,7 +13281,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.73, accepted purely on non-execution duration." + "value": "High severity CVE with EPSS 0.73 accepted only on duration." } ] }, @@ -13387,11 +13387,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS (0.0); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -13501,7 +13501,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.18, accepted purely on non-execution duration." + "value": "High severity CVE accepted only on duration." } ] }, @@ -13607,11 +13607,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -13721,7 +13721,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.57, accepted purely on non-execution duration." + "value": "High severity CVE with elevated EPSS (0.57) accepted only on duration." } ] }, @@ -13827,11 +13827,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -13937,11 +13937,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.02); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -14047,11 +14047,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.02); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -14157,11 +14157,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.02); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -14267,11 +14267,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.02); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -14381,7 +14381,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.6, accepted purely on non-execution duration." + "value": "High severity CVE with elevated EPSS (0.6) accepted only on duration." } ] }, @@ -14491,7 +14491,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.23, accepted purely on non-execution duration." + "value": "High severity CVE with elevated EPSS (0.23) accepted only on duration." } ] }, @@ -14601,7 +14601,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed (HTTP/2 Rapid Reset), EPSS 1.0 - requires human verification rather than duration-only acceptance." + "value": "High severity, KEV-listed HTTP/2 rapid-reset CVE with EPSS 1.0 accepted only on duration; needs verification." } ] }, @@ -14711,7 +14711,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.21, accepted purely on non-execution duration." + "value": "High severity CVE accepted only on duration." } ] }, @@ -14817,11 +14817,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -14927,11 +14927,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.01); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -15037,11 +15037,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.09); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -15151,7 +15151,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.57, accepted purely on non-execution duration." + "value": "High severity CVE with elevated EPSS (0.57) accepted only on duration." } ] }, @@ -15261,7 +15261,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -15371,7 +15371,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable, though EPSS is notable it\u0027s below high/critical threshold." } ] }, @@ -15481,7 +15481,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -15591,7 +15591,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -15701,7 +15701,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -15811,7 +15811,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -15921,7 +15921,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -16031,7 +16031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -16141,7 +16141,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity despite high EPSS; below the critical/high threshold the rubric targets, and duration is well past policy minimum." + "value": "Medium severity (4.3); duration-based acceptance reasonable." } ] }, @@ -16249,7 +16249,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on despite critical severity." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -16357,7 +16357,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -16465,7 +16465,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -16573,7 +16573,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -16681,7 +16681,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on despite critical severity." + "value": "code_not_reachable, structural fact, safe as-is despite critical severity." } ] }, @@ -16789,7 +16789,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is despite critical severity." } ] }, @@ -16897,7 +16897,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -17005,7 +17005,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -17113,7 +17113,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -17221,7 +17221,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -17329,7 +17329,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -17437,7 +17437,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -17545,7 +17545,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -17651,7 +17651,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -17759,7 +17759,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on despite critical severity." + "value": "code_not_reachable, structural fact, safe as-is despite critical severity." } ] }, @@ -17867,7 +17867,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -17975,7 +17975,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -18083,7 +18083,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -18191,7 +18191,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -18301,7 +18301,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.0) thymeleaf CVE accepted solely on non-execution duration despite substantial library usage (367/549 classes); worth verifying." + "value": "Critical CVE on thymeleaf accepted only on duration; library heavily used (367/549 classes)." } ] }, @@ -18411,7 +18411,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.0) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration on a heavily used library." } ] }, @@ -18521,7 +18521,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.0) accepted solely on non-execution duration." + "value": "Critical CVE accepted only on duration on a heavily used library." } ] }, @@ -18627,11 +18627,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.04); acceptable, and library usage is minimal (4/347 classes)." + "value": "High severity CVE on mysql-connector-java accepted only on duration." } ] }, @@ -18737,11 +18737,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.01); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -18851,7 +18851,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -18959,7 +18959,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -19067,7 +19067,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 0 classes loaded, structural, safe to rely on." + "value": "code_not_reachable (0 of 0 classes), structural fact, safe as-is." } ] }, @@ -19173,11 +19173,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.01); acceptable." + "value": "High severity CVE on spring-boot accepted only on duration; library actively used (183/458 classes)." } ] }, @@ -19283,11 +19283,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS (0.0); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -19393,11 +19393,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS (0.0); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -19507,7 +19507,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -19615,7 +19615,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -19723,7 +19723,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -19829,11 +19829,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but EPSS just under the 0.15 flag threshold (0.12); acceptable given long observation, though close enough to note if reviewing anyway." + "value": "High severity CVE on gson accepted only on duration; library actively used (36/174 classes)." } ] }, @@ -19941,7 +19941,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -20049,7 +20049,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -20157,7 +20157,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -20265,7 +20265,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -20373,7 +20373,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -20481,7 +20481,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -20591,7 +20591,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with very high EPSS (0.81, 99.6th pct) accepted purely on non-execution duration despite the library being loaded (7/1501 classes) - worth verifying given the strong exploitability signal." + "value": "High severity CVE on xalan with high EPSS (0.81) accepted only on duration despite the library being loaded (7/1501 classes); should be verified." } ] }, @@ -20697,11 +20697,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable." + "value": "High severity CVE on spring-core accepted only on duration; library heavily used (334/791 classes)." } ] }, @@ -20807,11 +20807,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.09; acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -20917,11 +20917,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS; acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -21027,11 +21027,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -21141,7 +21141,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -21251,7 +21251,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity, though EPSS is notable (0.35); acceptable at medium severity." } ] }, @@ -21361,7 +21361,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -21471,7 +21471,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -21577,11 +21577,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS; acceptable." + "value": "High severity CVE on spring-expression accepted only on duration; library actively used (91/142 classes)." } ] }, @@ -21687,11 +21687,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS; acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -21797,11 +21797,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS; acceptable." + "value": "High severity CVE accepted only on duration." } ] }, @@ -21911,7 +21911,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -22021,7 +22021,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -22131,7 +22131,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity (despite EPSS 0.36); below the critical/high threshold the rubric targets." + "value": "Medium severity, though EPSS is notable (0.36); acceptable at medium severity." } ] }, @@ -22241,7 +22241,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -22351,7 +22351,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -22457,11 +22457,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.01); acceptable." + "value": "High severity CVE on spring-boot-autoconfigure accepted only on duration; library actively used (195/848 classes)." } ] }, @@ -22571,7 +22571,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -22677,11 +22677,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable." + "value": "High severity CVE on hibernate-core accepted only on duration; library heavily used (1563/3787 classes)." } ] }, @@ -22791,7 +22791,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -22897,11 +22897,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS (0.0); acceptable." + "value": "High severity CVE on hibernate-validator accepted only on duration; library actively used (225/459 classes)." } ] }, @@ -23007,11 +23007,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS (0.0); acceptable, and library usage is minimal (5/1717 classes)." + "value": "High severity CVE on guava accepted only on duration." } ] }, @@ -23121,7 +23121,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; acceptable." + "value": "Low severity; duration-based acceptance reasonable." } ] }, @@ -23229,7 +23229,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -23337,7 +23337,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -23447,7 +23447,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -23557,7 +23557,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -23667,7 +23667,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -23775,7 +23775,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -23883,7 +23883,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -23991,7 +23991,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -24099,7 +24099,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -24207,7 +24207,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -24315,7 +24315,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -24423,7 +24423,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -24531,7 +24531,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable on commons-lang3 (0/152 classes), structural, safe to rely on." + "value": "code_not_reachable on commons-lang3, structural fact, safe as-is." } ] }, @@ -24639,7 +24639,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable on commons-lang3 (0/152 classes), structural, safe to rely on." + "value": "code_not_reachable on commons-lang3, structural fact, safe as-is." } ] }, @@ -24749,7 +24749,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -24859,7 +24859,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -24969,7 +24969,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -25079,7 +25079,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity on spring-context; acceptable." + "value": "Medium severity on spring-context; duration-based acceptance reasonable." } ] }, @@ -25189,7 +25189,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; acceptable." + "value": "Low severity; duration-based acceptance reasonable." } ] }, @@ -25297,7 +25297,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -25405,7 +25405,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -25513,7 +25513,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural, safe to rely on." + "value": "code_not_reachable, structural fact, safe as-is." } ] }, @@ -25623,7 +25623,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable." + "value": "Medium severity; duration-based acceptance reasonable." } ] }, @@ -25731,7 +25731,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index b2ebd0d..b010847 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -508,6 +508,16 @@ private String generateReport(List appResults, List entrie } } + sb.append("\n### Legend\n\n"); + sb.append("**VEX** - `NA` = not_affected, `IT` = in_triage\n\n"); + sb.append("**Rationale code:**\n\n"); + sb.append("| Code | Meaning |\n|------|---------|\n"); + sb.append("| `UNU` | Unused - library never loaded at runtime (0 classes) |\n"); + sb.append("| `SHD` | Shielded - CVE Shield/Protect actively mitigating at runtime |\n"); + sb.append("| `AGD` | Aged out - not_affected on duration alone (no observed execution past the acceptance threshold) |\n"); + sb.append("| `WCH` | Watching - in_triage, still within the acceptance window |\n"); + sb.append("| `!` suffix | Flagged `needs_review` by the VEX Advisor - see the app's Risk Rationale above |\n"); + sb.append("\n---\n\n## Application Detail\n\n"); List order = java.util.Arrays.asList("CRITICAL", "HIGH", "MEDIUM", "LOW", "SOUND", "UNKNOWN"); @@ -516,6 +526,7 @@ private String generateReport(List appResults, List entrie int idx = order.indexOf(getString(r, "risk_level", "UNKNOWN")); return idx < 0 ? 99 : idx; })); + List severityOrder = java.util.Arrays.asList("critical", "high", "medium", "low", "unknown"); for (JsonObject r : sortedResults) { String appName = getString(r, "application", "Unknown"); @@ -530,40 +541,27 @@ private String generateReport(List appResults, List entrie Map statementAssessments = assessmentsByApp.getOrDefault(appName, Map.of()); if (entry != null) { - List needsReview = new ArrayList<>(); - List sound = new ArrayList<>(); - for (VexStatement s : entry.statements) { - JsonObject assessment = statementAssessments.get(s.cveId); - String assessLabel = assessment != null ? getString(assessment, "assessment", "unknown") : "unknown"; - if ("needs_review".equals(assessLabel)) needsReview.add(s); - else sound.add(s); - } - - if (!needsReview.isEmpty()) { - sb.append("#### Needs Review (").append(needsReview.size()).append(")\n\n"); - sb.append("| CVE | Library | Severity | State | Rationale |\n|-----|---------|----------|-------|-----------|\n"); - for (VexStatement s : needsReview) { - JsonObject assessment = statementAssessments.get(s.cveId); - String rationale = assessment != null ? getString(assessment, "rationale", "") : ""; - sb.append("| ").append(s.cveId).append(" | `").append(s.purl != null ? s.purl : "unknown") - .append("` | ").append(s.severity != null ? s.severity : "unknown").append(" | ") - .append(s.state).append(" | ").append(rationale.replace("|", "\\|")).append(" |\n"); - } - sb.append("\n"); - } - - if (!sound.isEmpty()) { - sb.append("#### Sound (").append(sound.size()).append(")\n\n"); - sb.append("
").append(sound.size()) - .append(" claim(s) assessed as sound as-is - expand for the full list\n\n"); - sb.append("| CVE | Library | Severity | State |\n|-----|---------|----------|-------|\n"); - for (VexStatement s : sound) { - sb.append("| ").append(s.cveId).append(" | `").append(s.purl != null ? s.purl : "unknown") - .append("` | ").append(s.severity != null ? s.severity : "unknown").append(" | ") - .append(s.state).append(" |\n"); - } - sb.append("\n
\n\n"); + List statements = new ArrayList<>(entry.statements); + statements.sort((a, b) -> { + boolean aFlagged = isFlagged(statementAssessments, a); + boolean bFlagged = isFlagged(statementAssessments, b); + if (aFlagged != bFlagged) return aFlagged ? -1 : 1; + int aSev = severityOrder.indexOf(a.severity != null ? a.severity.toLowerCase() : "unknown"); + int bSev = severityOrder.indexOf(b.severity != null ? b.severity.toLowerCase() : "unknown"); + if (aSev < 0) aSev = severityOrder.size(); + if (bSev < 0) bSev = severityOrder.size(); + return Integer.compare(aSev, bSev); + }); + + sb.append("| CVE | Library | Score | VEX | Rationale |\n|-----|---------|-------|-----|-----------|\n"); + for (VexStatement s : statements) { + boolean flagged = isFlagged(statementAssessments, s); + sb.append("| ").append(s.cveId).append(" | ").append(plainLibrary(s.purl)) + .append(" | ").append(s.score != null ? s.score : "-").append(" | ") + .append("in_triage".equals(s.state) ? "IT" : "NA").append(" | ") + .append(rationaleCode(s)).append(flagged ? "!" : "").append(" |\n"); } + sb.append("\n"); } sb.append("---\n\n"); @@ -573,15 +571,36 @@ private String generateReport(List appResults, List entrie sb.append("VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and ") .append("per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This ") .append("advisor does not change any claim; it only assesses whether relying on each claim as generated is ") - .append("reasonable given the CVE's severity and exploitability.\n\n"); - sb.append("- **sound**: the claim's justification (structural fact or active control) supports relying on it as-is\n"); - sb.append("- **needs_review**: the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or ") + .append("reasonable given the CVE's severity and exploitability. See the Legend above for the VEX/Rationale ") + .append("codes used in the per-application tables.\n\n"); + sb.append("- **sound** (no `!`): the claim's justification (structural fact or active control) supports relying on it as-is\n"); + sb.append("- **needs_review** (`!` suffix): the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or ") .append("is otherwise borderline - a human should confirm before treating it as resolved\n\n---\n\n"); sb.append("*Report generated by Contrast VEX Advisor*\n*Powered by Contrast Security Runtime Observability*\n"); return sb.toString(); } + private boolean isFlagged(Map statementAssessments, VexStatement s) { + JsonObject assessment = statementAssessments.get(s.cveId); + return assessment != null && "needs_review".equals(getString(assessment, "assessment", "")); + } + + /** UNU/SHD structural justifications are always sound; AGD/WCH are duration-based and may be flagged. */ + private String rationaleCode(VexStatement s) { + if ("code_not_reachable".equals(s.justification)) return "UNU"; + if ("protected_at_runtime".equals(s.justification)) return "SHD"; + if ("in_triage".equals(s.state)) return "WCH"; + return "AGD"; + } + + /** Strips a purl down to "artifact@version" - drops the "pkg:maven//" prefix for a narrow column. */ + private String plainLibrary(String purl) { + if (purl == null) return "unknown"; + int lastSlash = purl.lastIndexOf('/'); + return lastSlash >= 0 ? purl.substring(lastSlash + 1) : purl; + } + private String formatCveList(List statements, int max) { List distinctCves = new ArrayList<>(new java.util.LinkedHashSet<>( statements.stream().map(s -> s.cveId).collect(java.util.stream.Collectors.toList()))); From 6b8d5ec179a4ea56a2994ebf3d74259c74d647dc Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 20:33:15 -0400 Subject: [PATCH 07/16] Add explicit Action column (Safe/Monitor/Review) to VEX Advisor table Replaces the "!" suffix on the Rationale code with a dedicated Action column, since the whole point of this report is telling a reviewer what to do next: - Safe: structural justification (UNU/SHD) - trust as-is regardless of severity - Monitor: duration-based justification (AGD/WCH), advisor assessed it as sound for now - Review: flagged needs_review by the advisor Rows now sort Review > Monitor > Safe (by severity within each) so the claims needing attention are grouped at the top of each table. Legend and appendix updated to match. Regenerated samples/sample-vex.json and sample-vex-advisor.md against SAML-PetClinic-Demo. --- README.md | 2 +- samples/sample-vex-advisor.md | 509 +++++++++--------- samples/sample-vex.json | 472 ++++++++-------- .../runtimeanalyst/VEXAdvisor.java | 33 +- 4 files changed, 518 insertions(+), 498 deletions(-) diff --git a/README.md b/README.md index 63c9e6b..612a1ff 100644 --- a/README.md +++ b/README.md @@ -221,7 +221,7 @@ Note: `PROTECTED_AT_RUNTIME` (CVE Shield/Protect actively mitigating) is impleme - **Quantum Advisor** - findings grouped by risk level (CRITICAL/HIGH/MEDIUM/LOW/NOT_QUANTUM_ISSUE), with an "Application Context" section describing each app from its architecture graph data - **AI Advisor** - organized as an inventory of AI-enabled applications (one section per app, not per finding): an AI-generated description of what the app does, then each AI usage instance with model/provider/endpoint and a description of what that specific call is doing, inferred from the key methods around it in the stack trace -- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Rationale`) using short codes - `UNU`/`SHD`/`AGD`/`WCH` plus a `!` suffix for `needs_review` - decoded in a legend, rather than a full-sentence rationale repeated per claim. +- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Action | Rationale`) using short codes - `Action` is `Safe`/`Monitor`/`Review`, `Rationale` is `UNU`/`SHD`/`AGD`/`WCH` - decoded in a legend, rather than a full-sentence rationale repeated per claim. Both the Quantum and AI Advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component. The VEX Advisor writes `contrast:vexAdvisorAssessment` (`sound`/`needs_review`) and `contrast:vexAdvisorRationale` back onto each vulnerability's `properties[]`. All of this happens automatically as part of every `--analyze` run, no separate step needed. diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index 52120ab..7c1c08f 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -27,16 +27,24 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated | Application | Risk Level | Statements | |-------------|------------|------------| -| SAML-PetClinic-Demo | CRITICAL | 235 | +| SAML-PetClinic-Demo | HIGH | 235 | | Risk Level | Applications | |------------|--------------| -| CRITICAL | 1 | +| HIGH | 1 | ### Legend **VEX** - `NA` = not_affected, `IT` = in_triage +**Action:** + +| Action | Meaning | +|--------|---------| +| `Safe` | Structural justification (`UNU`/`SHD`) - trust the claim as-is regardless of severity | +| `Monitor` | Duration-based justification (`AGD`/`WCH`), advisor assessed it as sound for now - keep watching | +| `Review` | Flagged `needs_review` by the VEX Advisor - human should confirm before relying on it (see the app's Risk Rationale above) | + **Rationale code:** | Code | Meaning | @@ -45,7 +53,6 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated | `SHD` | Shielded - CVE Shield/Protect actively mitigating at runtime | | `AGD` | Aged out - not_affected on duration alone (no observed execution past the acceptance threshold) | | `WCH` | Watching - in_triage, still within the acceptance window | -| `!` suffix | Flagged `needs_review` by the VEX Advisor - see the app's Risk Rationale above | --- @@ -53,260 +60,260 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated ### SAML-PetClinic-Demo -**Risk Level:** CRITICAL - -SAML-PetClinic-Demo has 235 VEX claims across roughly 40 libraries, most on jackson-databind 2.8.8, tomcat-embed-core 8.5.15, and the Spring 4.3.9/1.5.4 stack. About a third of claims rest on solid code_not_reachable (zero classes loaded) evidence and are safe to trust as-is; the rest, covering dozens of critical/high CVEs including three separate Spring4Shell (CVE-2022-22965) instances and Tomcat Ghostcat/rapid-reset KEV entries, are accepted purely on 288 days of no observed execution in a library that is otherwise heavily loaded and used. - -**Risk Rationale:** Several KEV-listed, high-EPSS critical CVEs (CVE-2022-22965 Spring4Shell across spring-data-commons/spring-webmvc/spring-beans, CVE-2020-1938 Ghostcat, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487) are marked not_affected using only duration-based absence-of-execution reasoning on libraries that are substantially loaded (100-1500+ classes in use), not structurally unreachable. Combined with the huge number of critical/high jackson-databind CVEs accepted the same way on a library with 263 of 582 classes actively used, this VEX set is not safe to rely on wholesale without human reachability verification on the flagged items. - -**Recommendation:** Prioritize manual review of the KEV/high-EPSS duration-only claims first: CVE-2022-22965 (spring-data-commons, spring-webmvc, spring-beans), CVE-2020-1938 and CVE-2017-12617 and CVE-2023-44487 and CVE-2025-24813 (tomcat-embed-core), and CVE-2018-1273 (spring-data-commons). Then work through the remaining critical/high jackson-databind, tomcat-embed-core, spring-web/-core/-expression, dom4j, hsqldb, logback, thymeleaf, mysql-connector-java, hibernate, guava, gson, and xalan claims flagged needs_review, ideally by confirming route-level reachability rather than relying on elapsed-time-without-execution. The code_not_reachable claims (snakeyaml, netty, jetty-http, plexus-utils, commons-compress, bootstrap, junit, commons-lang/-lang3, commons-io, httpclient, neko-htmlunit, htmlunit, spring-boot-starter-web/-actuator) can be trusted as-is. - -| CVE | Library | Score | VEX | Rationale | -|-----|---------|-------|-----|-----------| -| CVE-2018-14721 | jackson-databind@2.8.8 | 10.0 | NA | AGD! | -| CVE-2018-11307 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2017-17485 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2019-20330 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2018-14718 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2018-14719 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2020-9548 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2019-14540 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2020-9547 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2019-14892 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2018-19361 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2018-19360 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2018-19362 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2019-17267 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2017-7525 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2018-7489 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2019-17531 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | AGD! | -| CVE-2020-10683 | dom4j@1.6.1 | 9.8 | NA | AGD! | -| CVE-2022-22965 | spring-boot-starter-web@1.5.4.RELEASE | 9.8 | NA | UNU! | -| CVE-2018-1273 | spring-data-commons@1.13.4.RELEASE | 9.8 | NA | AGD! | -| CVE-2022-41853 | hsqldb@2.3.5 | 9.8 | NA | AGD! | -| CVE-2017-5929 | logback-core@1.1.11 | 9.8 | NA | AGD! | -| CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | AGD! | -| CVE-2022-22965 | spring-webmvc@4.3.9.RELEASE | 9.8 | NA | AGD! | -| CVE-2017-5929 | logback-classic@1.1.11 | 9.8 | NA | AGD! | -| CVE-2022-22965 | spring-beans@4.3.9.RELEASE | 9.8 | NA | AGD! | -| CVE-2018-8014 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | -| CVE-2025-24813 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | -| CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | -| CVE-2020-1938 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | -| CVE-2025-31651 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | -| CVE-2024-50379 | tomcat-embed-core@8.5.15 | 9.8 | NA | AGD! | -| CVE-2026-43515 | tomcat-embed-core@8.5.15 | 9.1 | NA | AGD! | -| CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | AGD! | -| CVE-2026-40477 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | AGD! | -| CVE-2026-40478 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | AGD! | -| CVE-2020-10673 | jackson-databind@2.8.8 | 8.8 | NA | AGD! | -| CVE-2020-35728 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-35491 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-35490 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36184 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36182 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36180 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36186 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36181 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36179 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-10650 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36185 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36188 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36187 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36189 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-36183 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2021-20190 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2018-5968 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-24616 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2020-24750 | jackson-databind@2.8.8 | 8.1 | NA | AGD! | -| CVE-2022-42004 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | -| CVE-2022-42003 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | -| CVE-2020-25649 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | -| CVE-2018-12023 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | -| CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | -| CVE-2019-14439 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | -| CVE-2018-12022 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | -| CVE-2019-12086 | jackson-databind@2.8.8 | 7.5 | NA | AGD! | -| CVE-2018-1000632 | dom4j@1.6.1 | 7.5 | NA | AGD! | -| CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | AGD! | -| CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | AGD! | -| CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | AGD! | -| CVE-2024-22243 | spring-web@4.3.9.RELEASE | 8.1 | NA | AGD! | -| CVE-2024-22262 | spring-web@4.3.9.RELEASE | 8.1 | NA | AGD! | -| CVE-2024-22259 | spring-web@4.3.9.RELEASE | 8.1 | NA | AGD! | -| CVE-2026-41842 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | AGD! | -| CVE-2024-38819 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | AGD! | -| CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | AGD! | -| CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | AGD! | -| CVE-2017-12617 | tomcat-embed-core@8.5.15 | 8.1 | NA | AGD! | -| CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2018-8034 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2019-17563 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2023-46589 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2025-55752 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2026-43513 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2021-25122 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2025-48988 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2025-49125 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2025-53506 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2025-52520 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2025-31650 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2023-44487 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2018-1336 | tomcat-embed-core@8.5.15 | 7.5 | NA | AGD! | -| CVE-2025-46701 | tomcat-embed-core@8.5.15 | 7.3 | NA | AGD! | -| CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | AGD! | -| CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | AGD! | -| CVE-2020-9484 | tomcat-embed-core@8.5.15 | 7.0 | NA | AGD! | -| CVE-2018-3258 | mysql-connector-java@5.1.42 | 8.8 | NA | AGD! | -| CVE-2023-22102 | mysql-connector-java@5.1.42 | 8.3 | NA | AGD! | -| CVE-2022-27772 | spring-boot@1.5.4.RELEASE | 7.8 | NA | AGD! | -| CVE-2025-22235 | spring-boot@1.5.4.RELEASE | 7.3 | NA | AGD! | -| CVE-2026-40973 | spring-boot@1.5.4.RELEASE | 7.0 | NA | AGD! | -| CVE-2022-25647 | gson@2.8.0 | 7.5 | NA | AGD! | -| CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | AGD! | -| CVE-2018-1272 | spring-core@4.3.9.RELEASE | 7.5 | NA | AGD! | -| CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | AGD! | -| CVE-2026-41848 | spring-core@4.3.9.RELEASE | 7.5 | NA | AGD! | -| CVE-2018-11040 | spring-core@4.3.9.RELEASE | 7.5 | NA | AGD! | -| CVE-2026-41850 | spring-expression@4.3.9.RELEASE | 7.5 | NA | AGD! | -| CVE-2026-41851 | spring-expression@4.3.9.RELEASE | 7.5 | NA | AGD! | -| CVE-2026-41849 | spring-expression@4.3.9.RELEASE | 7.5 | NA | AGD! | -| CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | AGD! | -| CVE-2020-25638 | hibernate-core@5.0.4.Final | 7.4 | NA | AGD! | -| CVE-2017-7536 | hibernate-validator@5.3.5.Final | 7.0 | NA | AGD! | -| CVE-2023-2976 | guava@19.0 | 7.1 | NA | AGD! | -| CVE-2023-26119 | htmlunit@2.21 | 9.8 | NA | UNU | -| CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | UNU | -| CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | UNU | -| CVE-2019-20445 | netty@3.5.7.Final | 9.1 | NA | UNU | -| CVE-2019-20444 | netty@3.5.7.Final | 9.1 | NA | UNU | -| CVE-2026-2332 | jetty-http@9.4.5.v20170502 | 9.1 | NA | UNU | -| CVE-2020-5529 | htmlunit@2.21 | 8.1 | NA | UNU | -| CVE-2022-25857 | snakeyaml@1.17 | 7.5 | NA | UNU | -| CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | UNU | -| CVE-2025-67030 | plexus-utils@3.0.8 | 8.8 | NA | UNU | -| CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | UNU | -| CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | UNU | -| CVE-2021-37137 | netty@3.5.7.Final | 7.5 | NA | UNU | -| CVE-2019-16869 | netty@3.5.7.Final | 7.5 | NA | UNU | -| CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | UNU | -| CVE-2022-28366 | neko-htmlunit@2.21 | 7.5 | NA | UNU | -| CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | UNU | -| CVE-2021-36090 | commons-compress@1.9 | 7.5 | NA | UNU | -| CVE-2021-35516 | commons-compress@1.9 | 7.5 | NA | UNU | -| CVE-2021-35517 | commons-compress@1.9 | 7.5 | NA | UNU | -| CVE-2021-35515 | commons-compress@1.9 | 7.5 | NA | UNU | -| CVE-2019-12384 | jackson-databind@2.8.8 | 5.9 | NA | AGD | -| CVE-2019-12814 | jackson-databind@2.8.8 | 5.9 | NA | AGD | -| CVE-2022-38749 | snakeyaml@1.17 | 6.5 | NA | UNU | -| CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | UNU | -| CVE-2022-38751 | snakeyaml@1.17 | 6.5 | NA | UNU | -| CVE-2022-38752 | snakeyaml@1.17 | 6.5 | NA | UNU | -| CVE-2022-38750 | snakeyaml@1.17 | 5.5 | NA | UNU | -| CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | AGD | -| CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | AGD | -| CVE-2021-42550 | logback-core@1.1.11 | 6.6 | NA | AGD | -| CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | AGD | -| CVE-2024-38820 | spring-web@4.3.9.RELEASE | 5.3 | NA | AGD | -| CVE-2024-38809 | spring-web@4.3.9.RELEASE | 5.3 | NA | AGD | -| CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | AGD | -| CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | AGD | -| CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | AGD | -| CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | AGD | -| CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | AGD | -| CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | AGD | -| CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | AGD | -| CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | AGD | -| CVE-2018-1305 | tomcat-embed-core@8.5.15 | 6.5 | NA | AGD | -| CVE-2019-0221 | tomcat-embed-core@8.5.15 | 6.1 | NA | AGD | -| CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | AGD | -| CVE-2018-8037 | tomcat-embed-core@8.5.15 | 5.9 | NA | AGD | -| CVE-2018-1304 | tomcat-embed-core@8.5.15 | 5.9 | NA | AGD | -| CVE-2025-61795 | tomcat-embed-core@8.5.15 | 5.3 | NA | AGD | -| CVE-2024-21733 | tomcat-embed-core@8.5.15 | 5.3 | NA | AGD | -| CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | AGD | -| CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | AGD | -| CVE-2022-4245 | plexus-utils@3.0.8 | 4.3 | NA | UNU | -| CVE-2021-43797 | netty@3.5.7.Final | 6.5 | NA | UNU | -| CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | UNU | -| CVE-2021-21295 | netty@3.5.7.Final | 5.9 | NA | UNU | -| CVE-2021-21290 | netty@3.5.7.Final | 5.5 | NA | UNU | -| CVE-2025-11143 | jetty-http@9.4.5.v20170502 | 6.5 | NA | UNU | -| CVE-2024-6763 | jetty-http@9.4.5.v20170502 | 5.3 | NA | UNU | -| CVE-2023-40167 | jetty-http@9.4.5.v20170502 | 5.3 | NA | UNU | -| CVE-2019-2692 | mysql-connector-java@5.1.42 | 6.3 | NA | AGD | -| CVE-2018-1196 | spring-boot@1.5.4.RELEASE | 5.9 | NA | AGD | -| CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | UNU | -| CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | UNU | -| CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | AGD | -| CVE-2018-1271 | spring-core@4.3.9.RELEASE | 5.9 | NA | AGD | -| CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | AGD | -| CVE-2021-22096 | spring-core@4.3.9.RELEASE | 4.3 | NA | AGD | -| CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | AGD | -| CVE-2023-20861 | spring-expression@4.3.9.RELEASE | 6.5 | NA | AGD | -| CVE-2022-22950 | spring-expression@4.3.9.RELEASE | 6.5 | NA | AGD | -| CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | AGD | -| CVE-2024-38808 | spring-expression@4.3.9.RELEASE | 4.3 | NA | AGD | -| CVE-2024-23672 | tomcat-embed-websocket@8.5.15 | 6.3 | NA | AGD | -| CVE-2019-14900 | hibernate-core@5.0.4.Final | 6.5 | NA | AGD | -| CVE-2022-23437 | xercesimpl@2.11.0 | 6.5 | NA | AGD | -| CVE-2020-14338 | xercesimpl@2.11.0 | 5.3 | NA | AGD | -| CVE-2023-34055 | spring-boot-actuator@1.5.4.RELEASE | 6.5 | NA | AGD | -| CVE-2018-14042 | bootstrap@3.3.6 | 6.1 | NA | UNU | -| CVE-2018-14040 | bootstrap@3.3.6 | 6.1 | NA | UNU | -| CVE-2016-10735 | bootstrap@3.3.6 | 6.1 | NA | UNU | -| CVE-2019-8331 | bootstrap@3.3.6 | 6.1 | NA | UNU | -| CVE-2018-20677 | bootstrap@3.3.6 | 6.1 | NA | UNU | -| CVE-2018-20676 | bootstrap@3.3.6 | 6.1 | NA | UNU | -| CVE-2020-15250 | junit@4.12 | 5.5 | NA | UNU | -| CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | UNU | -| CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | UNU | -| CVE-2019-3797 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | AGD | -| CVE-2019-3802 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | AGD | -| CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | AGD | -| CVE-2024-38820 | spring-context@4.3.9.RELEASE | 5.3 | NA | AGD | -| CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | UNU | -| CVE-2021-29425 | commons-io@2.4 | 4.8 | NA | UNU | -| CVE-2024-47554 | commons-io@2.4 | 4.3 | NA | UNU | -| CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | AGD | -| CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | AGD | -| CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | UNU | -| CVE-2020-8908 | guava@19.0 | 3.3 | NA | AGD | -| CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | AGD | -| CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | AGD | -| CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | AGD | -| CVE-2026-1225 | logback-core@1.1.11 | 0.0 | NA | AGD | -| CVE-2026-9828 | logback-core@1.1.11 | 0.0 | NA | AGD | -| CVE-2025-11226 | logback-core@1.1.11 | 0.0 | NA | AGD | -| CVE-2024-12798 | logback-core@1.1.11 | 0.0 | NA | AGD | -| CVE-2024-12801 | logback-core@1.1.11 | 0.0 | NA | AGD | -| CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | UNU | -| CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | AGD | -| CVE-2012-0881 | xercesimpl@2.11.0 | 0.0 | NA | AGD | -| CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | AGD | -| CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | AGD | +**Risk Level:** HIGH + +SAML-PetClinic-Demo has 235 VEX claims across ~35 outdated libraries (jackson-databind 2.8.8, tomcat-embed-core 8.5.15, spring-web/webmvc/beans/core/context/expression 4.3.9, spring-data-commons, hibernate-core, and others). About 45% of claims rest on structural code_not_reachable evidence (0 classes loaded) and are sound as written. The remaining majority are duration-based not_affected claims (288 days observed, well past the 30-day threshold), and a large share of those cover critical or high severity CVEs, including several KEV-listed CVEs (CVE-2022-22965/Spring4Shell, CVE-2020-1938/Ghostcat, CVE-2017-12617, CVE-2023-44487, CVE-2018-1273, CVE-2025-24813), so those carry more residual risk than the claim language conveys. + +**Risk Rationale:** A large volume of not_affected claims on critical/high severity CVEs (roughly 130 of 235) rely solely on 288 days of no observed execution rather than structural non-reachability. This is a legitimate operational signal but a probabilistic one, and several of the affected libraries carry KEV-listed CVEs actively exploited in the wild (CVE-2022-22965 in spring-webmvc/spring-beans, CVE-2020-1938 and CVE-2017-12617 and CVE-2023-44487 and CVE-2025-24813 in tomcat-embed-core, CVE-2018-1273 in spring-data-commons). The jackson-databind 2.8.8 stack alone accounts for over 50 critical/high duration-based claims. None of these are individually unreasonable given 288 days > 30-day threshold, but the sheer concentration of critical/KEV exposure resting on absence-of-observation reasoning is the primary driver of the HIGH rating. + +**Recommendation:** Before relying on this VEX as-is, have a human re-verify the duration-based not_affected claims for the KEV-listed CVEs first (CVE-2022-22965 on spring-webmvc/spring-beans, CVE-2020-1938 and CVE-2017-12617 and CVE-2023-44487 and CVE-2025-24813 on tomcat-embed-core, CVE-2018-1273 on spring-data-commons), then spot-check the remaining critical-severity jackson-databind and tomcat-embed-core duration-based claims. The code_not_reachable claims (htmlunit, snakeyaml, netty, jetty-http, plexus-utils, commons-compress, bootstrap, junit, commons-lang/commons-lang3, httpclient, commons-io, neko-htmlunit) do not need re-review. Given how old and out-of-support most of these library versions are (Spring 4.x, Tomcat 8.5.15, Hibernate 5.0.4, jackson 2.8.8), an actual upgrade is the more durable fix rather than continuing to lean on runtime-absence reasoning. + +| CVE | Library | Score | VEX | Action | Rationale | +|-----|---------|-------|-----|--------|-----------| +| CVE-2018-14721 | jackson-databind@2.8.8 | 10.0 | NA | Review | AGD | +| CVE-2018-11307 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2017-17485 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2019-20330 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2018-14718 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2018-14719 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2020-9548 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2019-14540 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2020-9547 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2019-14892 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2018-19361 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2018-19360 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2018-19362 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2019-17267 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2017-7525 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2018-7489 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2019-17531 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | +| CVE-2020-10683 | dom4j@1.6.1 | 9.8 | NA | Review | AGD | +| CVE-2022-22965 | spring-boot-starter-web@1.5.4.RELEASE | 9.8 | NA | Review | UNU | +| CVE-2018-1273 | spring-data-commons@1.13.4.RELEASE | 9.8 | NA | Review | AGD | +| CVE-2022-41853 | hsqldb@2.3.5 | 9.8 | NA | Review | AGD | +| CVE-2017-5929 | logback-core@1.1.11 | 9.8 | NA | Review | AGD | +| CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | Review | AGD | +| CVE-2022-22965 | spring-webmvc@4.3.9.RELEASE | 9.8 | NA | Review | AGD | +| CVE-2017-5929 | logback-classic@1.1.11 | 9.8 | NA | Review | AGD | +| CVE-2022-22965 | spring-beans@4.3.9.RELEASE | 9.8 | NA | Review | AGD | +| CVE-2018-8014 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | +| CVE-2025-24813 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | +| CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | +| CVE-2020-1938 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | +| CVE-2025-31651 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | +| CVE-2024-50379 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | +| CVE-2026-43515 | tomcat-embed-core@8.5.15 | 9.1 | NA | Review | AGD | +| CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Review | AGD | +| CVE-2026-40477 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Review | AGD | +| CVE-2026-40478 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Review | AGD | +| CVE-2020-10673 | jackson-databind@2.8.8 | 8.8 | NA | Review | AGD | +| CVE-2020-35728 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-35491 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-35490 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36184 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36182 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36180 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36186 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36181 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36179 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-10650 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36185 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36188 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36187 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36189 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-36183 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2021-20190 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2018-5968 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-24616 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2020-24750 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | +| CVE-2022-42004 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | +| CVE-2022-42003 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | +| CVE-2020-25649 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | +| CVE-2018-12023 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | +| CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | +| CVE-2019-14439 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | +| CVE-2018-12022 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | +| CVE-2019-12086 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | +| CVE-2018-1000632 | dom4j@1.6.1 | 7.5 | NA | Review | AGD | +| CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | Review | AGD | +| CVE-2024-22243 | spring-web@4.3.9.RELEASE | 8.1 | NA | Review | AGD | +| CVE-2024-22262 | spring-web@4.3.9.RELEASE | 8.1 | NA | Review | AGD | +| CVE-2024-22259 | spring-web@4.3.9.RELEASE | 8.1 | NA | Review | AGD | +| CVE-2026-41842 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2024-38819 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | Review | AGD | +| CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | Review | AGD | +| CVE-2017-12617 | tomcat-embed-core@8.5.15 | 8.1 | NA | Review | AGD | +| CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2018-8034 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2019-17563 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2023-46589 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2025-55752 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2026-43513 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2021-25122 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2025-48988 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2025-49125 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2025-53506 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2025-52520 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2025-31650 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2023-44487 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2018-1336 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | +| CVE-2025-46701 | tomcat-embed-core@8.5.15 | 7.3 | NA | Review | AGD | +| CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | Review | AGD | +| CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | Review | AGD | +| CVE-2020-9484 | tomcat-embed-core@8.5.15 | 7.0 | NA | Review | AGD | +| CVE-2018-3258 | mysql-connector-java@5.1.42 | 8.8 | NA | Review | AGD | +| CVE-2023-22102 | mysql-connector-java@5.1.42 | 8.3 | NA | Review | AGD | +| CVE-2022-27772 | spring-boot@1.5.4.RELEASE | 7.8 | NA | Review | AGD | +| CVE-2025-22235 | spring-boot@1.5.4.RELEASE | 7.3 | NA | Review | AGD | +| CVE-2026-40973 | spring-boot@1.5.4.RELEASE | 7.0 | NA | Review | AGD | +| CVE-2022-25647 | gson@2.8.0 | 7.5 | NA | Review | AGD | +| CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | Review | AGD | +| CVE-2018-1272 | spring-core@4.3.9.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2026-41848 | spring-core@4.3.9.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2018-11040 | spring-core@4.3.9.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2026-41850 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2026-41851 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2026-41849 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | Review | AGD | +| CVE-2020-25638 | hibernate-core@5.0.4.Final | 7.4 | NA | Review | AGD | +| CVE-2017-7536 | hibernate-validator@5.3.5.Final | 7.0 | NA | Review | AGD | +| CVE-2023-2976 | guava@19.0 | 7.1 | NA | Review | AGD | +| CVE-2019-12384 | jackson-databind@2.8.8 | 5.9 | NA | Monitor | AGD | +| CVE-2019-12814 | jackson-databind@2.8.8 | 5.9 | NA | Monitor | AGD | +| CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Monitor | AGD | +| CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Monitor | AGD | +| CVE-2021-42550 | logback-core@1.1.11 | 6.6 | NA | Monitor | AGD | +| CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | Monitor | AGD | +| CVE-2024-38820 | spring-web@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2024-38809 | spring-web@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Monitor | AGD | +| CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Monitor | AGD | +| CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Monitor | AGD | +| CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Monitor | AGD | +| CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Monitor | AGD | +| CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2018-1305 | tomcat-embed-core@8.5.15 | 6.5 | NA | Monitor | AGD | +| CVE-2019-0221 | tomcat-embed-core@8.5.15 | 6.1 | NA | Monitor | AGD | +| CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | Monitor | AGD | +| CVE-2018-8037 | tomcat-embed-core@8.5.15 | 5.9 | NA | Monitor | AGD | +| CVE-2018-1304 | tomcat-embed-core@8.5.15 | 5.9 | NA | Monitor | AGD | +| CVE-2025-61795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Monitor | AGD | +| CVE-2024-21733 | tomcat-embed-core@8.5.15 | 5.3 | NA | Monitor | AGD | +| CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Monitor | AGD | +| CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | Monitor | AGD | +| CVE-2019-2692 | mysql-connector-java@5.1.42 | 6.3 | NA | Monitor | AGD | +| CVE-2018-1196 | spring-boot@1.5.4.RELEASE | 5.9 | NA | Monitor | AGD | +| CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | Monitor | AGD | +| CVE-2018-1271 | spring-core@4.3.9.RELEASE | 5.9 | NA | Monitor | AGD | +| CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2021-22096 | spring-core@4.3.9.RELEASE | 4.3 | NA | Monitor | AGD | +| CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Monitor | AGD | +| CVE-2023-20861 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Monitor | AGD | +| CVE-2022-22950 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Monitor | AGD | +| CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2024-38808 | spring-expression@4.3.9.RELEASE | 4.3 | NA | Monitor | AGD | +| CVE-2024-23672 | tomcat-embed-websocket@8.5.15 | 6.3 | NA | Monitor | AGD | +| CVE-2019-14900 | hibernate-core@5.0.4.Final | 6.5 | NA | Monitor | AGD | +| CVE-2022-23437 | xercesimpl@2.11.0 | 6.5 | NA | Monitor | AGD | +| CVE-2020-14338 | xercesimpl@2.11.0 | 5.3 | NA | Monitor | AGD | +| CVE-2023-34055 | spring-boot-actuator@1.5.4.RELEASE | 6.5 | NA | Monitor | AGD | +| CVE-2019-3797 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2019-3802 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2024-38820 | spring-context@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | +| CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | Monitor | AGD | +| CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | Monitor | AGD | +| CVE-2020-8908 | guava@19.0 | 3.3 | NA | Monitor | AGD | +| CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | Monitor | AGD | +| CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | Monitor | AGD | +| CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | +| CVE-2026-1225 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | +| CVE-2026-9828 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | +| CVE-2025-11226 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | +| CVE-2024-12798 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | +| CVE-2024-12801 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | +| CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | Monitor | AGD | +| CVE-2012-0881 | xercesimpl@2.11.0 | 0.0 | NA | Monitor | AGD | +| CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | Monitor | AGD | +| CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | Monitor | AGD | +| CVE-2023-26119 | htmlunit@2.21 | 9.8 | NA | Safe | UNU | +| CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Safe | UNU | +| CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Safe | UNU | +| CVE-2019-20445 | netty@3.5.7.Final | 9.1 | NA | Safe | UNU | +| CVE-2019-20444 | netty@3.5.7.Final | 9.1 | NA | Safe | UNU | +| CVE-2026-2332 | jetty-http@9.4.5.v20170502 | 9.1 | NA | Safe | UNU | +| CVE-2020-5529 | htmlunit@2.21 | 8.1 | NA | Safe | UNU | +| CVE-2022-25857 | snakeyaml@1.17 | 7.5 | NA | Safe | UNU | +| CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Safe | UNU | +| CVE-2025-67030 | plexus-utils@3.0.8 | 8.8 | NA | Safe | UNU | +| CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Safe | UNU | +| CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Safe | UNU | +| CVE-2021-37137 | netty@3.5.7.Final | 7.5 | NA | Safe | UNU | +| CVE-2019-16869 | netty@3.5.7.Final | 7.5 | NA | Safe | UNU | +| CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Safe | UNU | +| CVE-2022-28366 | neko-htmlunit@2.21 | 7.5 | NA | Safe | UNU | +| CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Safe | UNU | +| CVE-2021-36090 | commons-compress@1.9 | 7.5 | NA | Safe | UNU | +| CVE-2021-35516 | commons-compress@1.9 | 7.5 | NA | Safe | UNU | +| CVE-2021-35517 | commons-compress@1.9 | 7.5 | NA | Safe | UNU | +| CVE-2021-35515 | commons-compress@1.9 | 7.5 | NA | Safe | UNU | +| CVE-2022-38749 | snakeyaml@1.17 | 6.5 | NA | Safe | UNU | +| CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Safe | UNU | +| CVE-2022-38751 | snakeyaml@1.17 | 6.5 | NA | Safe | UNU | +| CVE-2022-38752 | snakeyaml@1.17 | 6.5 | NA | Safe | UNU | +| CVE-2022-38750 | snakeyaml@1.17 | 5.5 | NA | Safe | UNU | +| CVE-2022-4245 | plexus-utils@3.0.8 | 4.3 | NA | Safe | UNU | +| CVE-2021-43797 | netty@3.5.7.Final | 6.5 | NA | Safe | UNU | +| CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Safe | UNU | +| CVE-2021-21295 | netty@3.5.7.Final | 5.9 | NA | Safe | UNU | +| CVE-2021-21290 | netty@3.5.7.Final | 5.5 | NA | Safe | UNU | +| CVE-2025-11143 | jetty-http@9.4.5.v20170502 | 6.5 | NA | Safe | UNU | +| CVE-2024-6763 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Safe | UNU | +| CVE-2023-40167 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Safe | UNU | +| CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Safe | UNU | +| CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Safe | UNU | +| CVE-2018-14042 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | +| CVE-2018-14040 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | +| CVE-2016-10735 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | +| CVE-2019-8331 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | +| CVE-2018-20677 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | +| CVE-2018-20676 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | +| CVE-2020-15250 | junit@4.12 | 5.5 | NA | Safe | UNU | +| CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Safe | UNU | +| CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Safe | UNU | +| CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Safe | UNU | +| CVE-2021-29425 | commons-io@2.4 | 4.8 | NA | Safe | UNU | +| CVE-2024-47554 | commons-io@2.4 | 4.3 | NA | Safe | UNU | +| CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Safe | UNU | +| CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Safe | UNU | --- ## Appendix: Methodology -VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This advisor does not change any claim; it only assesses whether relying on each claim as generated is reasonable given the CVE's severity and exploitability. See the Legend above for the VEX/Rationale codes used in the per-application tables. +VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This advisor does not change any claim; it only assesses whether relying on each claim as generated is reasonable given the CVE's severity and exploitability. See the Legend above for the Action/VEX/Rationale codes used in the per-application tables. -- **sound** (no `!`): the claim's justification (structural fact or active control) supports relying on it as-is -- **needs_review** (`!` suffix): the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or is otherwise borderline - a human should confirm before treating it as resolved +- **Safe/Monitor** (sound): the claim's justification supports relying on it as-is - Safe is structural (the library is unused or an active control is mitigating it), Monitor is duration-based but currently well within reason +- **Review** (needs_review): the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or is otherwise borderline - a human should confirm before treating it as resolved --- diff --git a/samples/sample-vex.json b/samples/sample-vex.json index 1123d75..5a9080c 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -3,7 +3,7 @@ "specVersion": "1.6", "version": 1, "metadata": { - "timestamp": "2026-09-03T00:09:42Z", + "timestamp": "2026-09-03T00:29:08Z", "component": { "type": "application", "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", @@ -117,7 +117,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE (10.0) on jackson-databind accepted solely on 288 days without observed execution; the library is heavily loaded (263/582 classes) so absence-of-evidence is weak given the severity." + "value": "Critical (10.0) CVE on jackson-databind accepted purely on 288 days of non-execution, not structural reachability; absence-of-evidence is weak justification at this severity." } ] }, @@ -227,7 +227,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration; library is substantially loaded, warrants reachability confirmation." + "value": "Critical (9.8) duration-only claim on a partially-loaded (263/582) library; worth a human check before relying on it." } ] }, @@ -337,7 +337,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE with elevated EPSS (0.5) accepted only on duration; should be verified rather than trusted on absence-of-execution alone." + "value": "Critical severity with high EPSS (0.5, 98.8th pct) accepted on runtime-absence alone; strong candidate for manual reachability review." } ] }, @@ -447,7 +447,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based reasoning on a heavily loaded library." + "value": "Critical (9.8), high EPSS (97.9th pct); not_affected based only on 288 days without execution, not code_not_reachable." } ] }, @@ -557,7 +557,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration; not a structural non-reachability guarantee." + "value": "Critical severity duration-based claim; library partially loaded so path could still exist unexercised." } ] }, @@ -667,7 +667,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration; needs human reachability check." + "value": "Critical severity accepted solely on non-execution duration; should be reviewed given library is actively loaded." } ] }, @@ -777,7 +777,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical (9.8) duration-only justification; same jackson-databind deserialization family as other flagged CVEs." } ] }, @@ -887,7 +887,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity, duration-based acceptance only; warrants review before trusting the claim." } ] }, @@ -997,7 +997,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity, duration-based acceptance only; part of the jackson-databind polymorphic deserialization CVE cluster." } ] }, @@ -1107,7 +1107,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity with elevated EPSS (97th pct); relies only on 288-day non-execution window." } ] }, @@ -1217,7 +1217,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity duration-based claim on a partially loaded library; not a structural guarantee." } ] }, @@ -1327,7 +1327,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity, high EPSS (97th pct), duration-only justification." } ] }, @@ -1437,7 +1437,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity accepted purely on non-execution; deserves manual reachability confirmation." } ] }, @@ -1547,7 +1547,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity, duration-based justification only." } ] }, @@ -1657,7 +1657,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity, duration-based justification only, no structural reachability evidence." } ] }, @@ -1767,7 +1767,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity duration-based claim; recommend human review." } ] }, @@ -1877,7 +1877,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity, duration-based justification only." } ] }, @@ -1987,7 +1987,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity, duration-based justification only." } ] }, @@ -2097,7 +2097,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity accepted on absence-of-observation alone." } ] }, @@ -2207,7 +2207,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE with EPSS 0.38 accepted only on duration; deserves closer look given exploit interest." + "value": "Critical severity with very high EPSS (98.8th pct); duration-only claim should not be trusted without review." } ] }, @@ -2317,7 +2317,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity, elevated EPSS (97th pct), duration-based justification only." } ] }, @@ -2427,7 +2427,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity duration-based claim; warrants confirmation." } ] }, @@ -2537,7 +2537,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity, duration-only justification, part of jackson-databind gadget-chain cluster." } ] }, @@ -2647,7 +2647,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration-based observation." + "value": "Critical severity, duration-only justification." } ] }, @@ -2757,7 +2757,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity (8.8) jackson-databind CVE accepted only on duration; should be verified before trusting." + "value": "High severity (8.8) accepted purely on non-execution duration rather than code_not_reachable." } ] }, @@ -2867,7 +2867,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity duration-based claim on a partially loaded library." } ] }, @@ -2977,7 +2977,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -3087,7 +3087,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -3197,7 +3197,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -3307,7 +3307,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -3417,7 +3417,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -3527,7 +3527,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -3637,7 +3637,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -3747,7 +3747,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.21 accepted only on duration; worth confirming." + "value": "High severity with elevated EPSS (97.4th pct); duration-only justification." } ] }, @@ -3857,7 +3857,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -3967,7 +3967,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -4077,7 +4077,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -4187,7 +4187,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -4297,7 +4297,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -4407,7 +4407,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -4517,7 +4517,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -4627,7 +4627,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -4737,7 +4737,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -4847,7 +4847,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -4957,7 +4957,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -5067,7 +5067,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -5177,7 +5177,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.18 accepted only on duration." + "value": "High severity with elevated EPSS (97th pct); duration-only justification." } ] }, @@ -5287,7 +5287,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -5397,7 +5397,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -5507,7 +5507,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -5617,7 +5617,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration-based observation." + "value": "High severity, duration-only justification." } ] }, @@ -5727,7 +5727,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.22 accepted only on duration; worth confirming." + "value": "High severity with elevated EPSS (97.5th pct); duration-only justification." } ] }, @@ -5837,7 +5837,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance is reasonable given lower stakes." + "value": "Medium severity accepted on duration alone is acceptable; lower stakes if the reasoning is wrong." } ] }, @@ -5947,7 +5947,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance is reasonable given lower stakes." + "value": "Medium severity duration-based acceptance is reasonable." } ] }, @@ -6055,7 +6055,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable with 0 of 1295 classes loaded is a structural fact, reliable regardless of critical severity." + "value": "code_not_reachable with 0 of 1295 classes loaded is a structural fact, safe to rely on despite critical severity." } ] }, @@ -6163,7 +6163,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; structural fact, safe to rely on." + "value": "code_not_reachable, 0 classes loaded; structural non-reachability holds regardless of severity." } ] }, @@ -6273,7 +6273,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE on dom4j accepted only on duration despite 1 class of the library being actively loaded." + "value": "Critical severity (9.8) on dom4j accepted purely on duration despite the library being loaded (1/190 classes); needs review." } ] }, @@ -6383,7 +6383,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration on a library that is loaded (1 of 190 classes)." + "value": "High severity duration-based claim on a loaded library; worth confirming." } ] }, @@ -6491,7 +6491,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 206 classes loaded; structural fact even though EPSS is maximal, safe as-is." + "value": "code_not_reachable, 0 of 206 classes loaded; structural fact holds even though EPSS is maximal, since the library never loads at all." } ] }, @@ -6599,7 +6599,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -6707,7 +6707,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -6815,7 +6815,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; low-stakes and structurally sound." } ] }, @@ -6923,7 +6923,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -7031,7 +7031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -7139,7 +7139,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -7247,7 +7247,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -7355,7 +7355,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "On spring-beans, this is again Spring4Shell, KEV/EPSS 1.0, accepted only on duration on an actively used library (202/408 classes); needs verification." + "value": "Critical, KEV-listed Spring4Shell CVE on spring-beans accepted only via duration (202/408 classes loaded); high-priority for manual verification." } ] }, @@ -7465,7 +7465,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed CVE with EPSS 0.97 accepted only on duration on a library with 152 of 554 classes actively used; this is the type of claim that most needs verification before being relied on." + "value": "Critical severity, KEV-listed, extremely high EPSS (99.89th pct); accepted only on 288 days of non-execution against a loaded library (152/554 classes). This is the highest-priority claim to re-verify." } ] }, @@ -7575,7 +7575,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration on the same actively-used spring-data-commons library." + "value": "High severity duration-based claim tied to the same spring-data-commons component as the KEV CVE-2018-1273; worth reviewing together." } ] }, @@ -7685,7 +7685,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-only justification, though EPSS is very low; still worth a quick confirmation given the library is actively loaded." } ] }, @@ -7795,7 +7795,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, low EPSS, duration-based acceptance is reasonable at this stakes level." } ] }, @@ -7905,7 +7905,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, low EPSS, duration-based acceptance is reasonable." } ] }, @@ -8013,7 +8013,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unscored/unknown; low stakes for duration-based acceptance." + "value": "Severity unscored/effectively low stakes; duration-based acceptance is acceptable here." } ] }, @@ -8123,7 +8123,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE on hsqldb accepted only on duration despite 229 of 601 classes actively loaded." + "value": "Critical severity (9.8) on hsqldb accepted purely on runtime-absence despite 229/601 classes loaded; needs review." } ] }, @@ -8233,7 +8233,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "On logback-classic, critical CVE accepted only on duration; library actively used (63/178 classes)." + "value": "Critical severity on logback-classic, duration-only justification despite meaningful class loading (63/178)." } ] }, @@ -8343,7 +8343,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "On logback-classic, high severity CVE accepted only on duration." + "value": "High severity duration-based claim on logback-classic; worth confirming." } ] }, @@ -8453,7 +8453,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable at this stakes level." } ] }, @@ -8561,7 +8561,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." } ] }, @@ -8669,7 +8669,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." } ] }, @@ -8777,7 +8777,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." } ] }, @@ -8885,7 +8885,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." } ] }, @@ -8993,7 +8993,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." } ] }, @@ -9101,7 +9101,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." } ] }, @@ -9211,7 +9211,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE on spring-web accepted only on duration; EPSS 0.32 and library actively used (211/559 classes)." + "value": "Critical severity (9.8) on spring-web with elevated EPSS (98.2nd pct); duration-only justification against a loaded library (211/559 classes)." } ] }, @@ -9321,7 +9321,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration on an actively used library." + "value": "High severity duration-based claim on spring-web; worth confirming." } ] }, @@ -9431,7 +9431,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-based claim on spring-web; worth confirming." } ] }, @@ -9541,7 +9541,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-based claim on spring-web; worth confirming." } ] }, @@ -9651,7 +9651,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -9761,7 +9761,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity on spring-context; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable (spring-context instance)." } ] }, @@ -9871,7 +9871,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -9981,7 +9981,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "On spring-beans, this is again Spring4Shell, KEV/EPSS 1.0, accepted only on duration on an actively used library (202/408 classes); needs verification." + "value": "Critical, KEV-listed Spring4Shell CVE on spring-beans accepted only via duration (202/408 classes loaded); high-priority for manual verification." } ] }, @@ -10091,7 +10091,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on spring-webmvc accepted only on duration." + "value": "High severity duration-based claim on spring-webmvc; worth confirming." } ] }, @@ -10201,7 +10201,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (0.55) accepted only on duration." + "value": "High severity with elevated EPSS (98.95th pct); duration-only justification." } ] }, @@ -10311,7 +10311,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -10421,7 +10421,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -10531,7 +10531,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -10641,7 +10641,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -10751,7 +10751,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -10861,7 +10861,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -10971,7 +10971,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -11081,7 +11081,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; duration-based acceptance reasonable." + "value": "Low severity; duration-based acceptance is safe." } ] }, @@ -11191,7 +11191,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "On logback-classic, critical CVE accepted only on duration; library actively used (63/178 classes)." + "value": "Critical severity on logback-classic, duration-only justification despite meaningful class loading (63/178)." } ] }, @@ -11301,7 +11301,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "On logback-classic, high severity CVE accepted only on duration." + "value": "High severity duration-based claim on logback-classic; worth confirming." } ] }, @@ -11411,7 +11411,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "On spring-beans, this is again Spring4Shell, KEV/EPSS 1.0, accepted only on duration on an actively used library (202/408 classes); needs verification." + "value": "Critical, KEV-listed Spring4Shell CVE on spring-beans accepted only via duration (202/408 classes loaded); high-priority for manual verification." } ] }, @@ -11521,7 +11521,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -11631,7 +11631,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE on tomcat-embed-core accepted only on duration; library heavily used (387/1481 classes)." + "value": "Critical severity on tomcat-embed-core, duration-only justification against a substantially loaded library (387/1481 classes)." } ] }, @@ -11741,7 +11741,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed CVE with EPSS 1.0 accepted only on duration on heavily used tomcat-embed-core; top-priority claim to verify." + "value": "Critical, KEV-listed, EPSS near 1.0; accepted purely on runtime-absence. High-priority re-verification target." } ] }, @@ -11851,7 +11851,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration." + "value": "Critical severity, duration-only justification on tomcat-embed-core." } ] }, @@ -11961,7 +11961,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed \u0027Ghostcat\u0027 CVE with EPSS 0.99 accepted only on duration; needs manual verification." + "value": "Critical, KEV-listed Ghostcat vulnerability with EPSS 0.99; accepted purely on non-execution duration. High-priority re-verification target." } ] }, @@ -12071,7 +12071,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration." + "value": "Critical severity, duration-only justification on tomcat-embed-core." } ] }, @@ -12181,7 +12181,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE with elevated EPSS (0.44) accepted only on duration." + "value": "Critical severity with elevated EPSS (98.7th pct); duration-only justification." } ] }, @@ -12291,7 +12291,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration." + "value": "Critical severity, duration-only justification on tomcat-embed-core." } ] }, @@ -12401,7 +12401,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 1.0 accepted only on duration." + "value": "High severity with maximal EPSS (99.95th pct); duration-only justification." } ] }, @@ -12511,7 +12511,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, KEV-listed CVE with EPSS 1.0 accepted only on duration; needs verification." + "value": "High severity, KEV-listed, EPSS near max; accepted purely on runtime-absence despite active library loading. High-priority re-verification target." } ] }, @@ -12621,7 +12621,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.73 accepted only on duration." + "value": "High severity with elevated EPSS (99.4th pct); duration-only justification." } ] }, @@ -12731,7 +12731,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -12841,7 +12841,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -12951,7 +12951,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -13061,7 +13061,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.67 accepted only on duration." + "value": "High severity with elevated EPSS (99.2nd pct); duration-only justification." } ] }, @@ -13171,7 +13171,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -13281,7 +13281,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.73 accepted only on duration." + "value": "High severity with elevated EPSS (99.4th pct); duration-only justification." } ] }, @@ -13391,7 +13391,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -13501,7 +13501,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -13611,7 +13611,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -13721,7 +13721,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (0.57) accepted only on duration." + "value": "High severity with elevated EPSS (99th pct); duration-only justification." } ] }, @@ -13831,7 +13831,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -13941,7 +13941,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -14051,7 +14051,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -14161,7 +14161,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -14271,7 +14271,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -14381,7 +14381,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (0.6) accepted only on duration." + "value": "High severity with elevated EPSS (99.1st pct); duration-only justification." } ] }, @@ -14491,7 +14491,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (0.23) accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -14601,7 +14601,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, KEV-listed HTTP/2 rapid-reset CVE with EPSS 1.0 accepted only on duration; needs verification." + "value": "High severity, KEV-listed (HTTP/2 Rapid Reset), EPSS 1.0; accepted purely on non-execution duration. High-priority re-verification target." } ] }, @@ -14711,7 +14711,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -14821,7 +14821,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -14931,7 +14931,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -15041,7 +15041,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity, duration-only justification on tomcat-embed-core." } ] }, @@ -15151,7 +15151,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (0.57) accepted only on duration." + "value": "High severity with elevated EPSS (99th pct); duration-only justification." } ] }, @@ -15261,7 +15261,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -15371,7 +15371,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable, though EPSS is notable it\u0027s below high/critical threshold." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -15481,7 +15481,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -15591,7 +15591,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -15701,7 +15701,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -15811,7 +15811,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -15921,7 +15921,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -16031,7 +16031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -16141,7 +16141,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity (4.3); duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -16249,7 +16249,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 of 102 classes loaded; structural fact holds regardless of critical severity." } ] }, @@ -16357,7 +16357,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -16465,7 +16465,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -16573,7 +16573,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -16681,7 +16681,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is despite critical severity." + "value": "code_not_reachable, 0 of 727 classes loaded for netty; structural fact holds regardless of severity." } ] }, @@ -16789,7 +16789,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is despite critical severity." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -16897,7 +16897,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -17005,7 +17005,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -17113,7 +17113,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -17221,7 +17221,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -17329,7 +17329,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -17437,7 +17437,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -17545,7 +17545,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -17651,7 +17651,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and unscored severity; safe as-is." } ] }, @@ -17759,7 +17759,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is despite critical severity." + "value": "code_not_reachable, 0 of 81 classes loaded for jetty-http; structural fact holds despite critical severity." } ] }, @@ -17867,7 +17867,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -17975,7 +17975,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -18083,7 +18083,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -18191,7 +18191,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and low severity; safe as-is." } ] }, @@ -18301,7 +18301,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE on thymeleaf accepted only on duration; library heavily used (367/549 classes)." + "value": "Critical severity (9.0) on thymeleaf accepted purely on duration despite significant class loading (367/549); worth confirming." } ] }, @@ -18411,7 +18411,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration on a heavily used library." + "value": "Critical severity, duration-only justification on thymeleaf." } ] }, @@ -18521,7 +18521,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE accepted only on duration on a heavily used library." + "value": "Critical severity, duration-only justification on thymeleaf." } ] }, @@ -18631,7 +18631,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on mysql-connector-java accepted only on duration." + "value": "High severity (8.8) duration-based claim on mysql-connector-java; only 4 of 347 classes loaded, so worth confirming which classes are actually exercised." } ] }, @@ -18741,7 +18741,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-based claim on mysql-connector-java; worth confirming." } ] }, @@ -18851,7 +18851,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -18959,7 +18959,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." } ] }, @@ -19067,7 +19067,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable (0 of 0 classes), structural fact, safe as-is." + "value": "code_not_reachable, 0 of 0 classes loaded; structural fact holds despite high severity." } ] }, @@ -19177,7 +19177,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on spring-boot accepted only on duration; library actively used (183/458 classes)." + "value": "High severity duration-based claim on spring-boot; worth confirming." } ] }, @@ -19287,7 +19287,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-based claim on spring-boot; worth confirming." } ] }, @@ -19397,7 +19397,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-based claim on spring-boot; worth confirming." } ] }, @@ -19507,7 +19507,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -19615,7 +19615,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 of 53 classes loaded for neko-htmlunit; safe as-is." } ] }, @@ -19723,7 +19723,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -19833,7 +19833,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on gson accepted only on duration; library actively used (36/174 classes)." + "value": "High severity duration-based claim on gson with partial class loading (36/174); worth confirming." } ] }, @@ -19941,7 +19941,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 of 200 classes loaded for commons-compress; structural fact holds despite high severity." } ] }, @@ -20049,7 +20049,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -20157,7 +20157,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -20265,7 +20265,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -20373,7 +20373,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -20481,7 +20481,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable and medium severity; safe as-is." } ] }, @@ -20591,7 +20591,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on xalan with high EPSS (0.81) accepted only on duration despite the library being loaded (7/1501 classes); should be verified." + "value": "High severity with high EPSS (0.81, 99.6th pct) on xalan; accepted on duration alone despite 7/1501 classes being loaded. Worth confirming which classes execute." } ] }, @@ -20701,7 +20701,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on spring-core accepted only on duration; library heavily used (334/791 classes)." + "value": "High severity duration-based claim on spring-core; worth confirming given substantial class loading (334/791)." } ] }, @@ -20811,7 +20811,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-based claim on spring-core; worth confirming." } ] }, @@ -20921,7 +20921,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-based claim on spring-core; worth confirming." } ] }, @@ -21031,7 +21031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-based claim on spring-core; worth confirming." } ] }, @@ -21141,7 +21141,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -21251,7 +21251,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, though EPSS is notable (0.35); acceptable at medium severity." + "value": "Medium severity, duration-based acceptance is reasonable despite moderate EPSS." } ] }, @@ -21361,7 +21361,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -21471,7 +21471,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -21581,7 +21581,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on spring-expression accepted only on duration; library actively used (91/142 classes)." + "value": "High severity duration-based claim on spring-expression; worth confirming." } ] }, @@ -21691,7 +21691,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-based claim on spring-expression; worth confirming." } ] }, @@ -21801,7 +21801,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted only on duration." + "value": "High severity duration-based claim on spring-expression; worth confirming." } ] }, @@ -21911,7 +21911,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -22021,7 +22021,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -22131,7 +22131,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, though EPSS is notable (0.36); acceptable at medium severity." + "value": "Medium severity, duration-based acceptance is reasonable despite moderate EPSS." } ] }, @@ -22241,7 +22241,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -22351,7 +22351,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -22461,7 +22461,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on spring-boot-autoconfigure accepted only on duration; library actively used (195/848 classes)." + "value": "High severity duration-based claim on spring-boot-autoconfigure; worth confirming." } ] }, @@ -22571,7 +22571,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -22681,7 +22681,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on hibernate-core accepted only on duration; library heavily used (1563/3787 classes)." + "value": "High severity duration-based claim on hibernate-core with heavy class loading (1563/3787); worth confirming." } ] }, @@ -22791,7 +22791,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -22901,7 +22901,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on hibernate-validator accepted only on duration; library actively used (225/459 classes)." + "value": "High severity duration-based claim on hibernate-validator; worth confirming." } ] }, @@ -23011,7 +23011,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE on guava accepted only on duration." + "value": "High severity duration-based claim on guava; worth confirming." } ] }, @@ -23121,7 +23121,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; duration-based acceptance reasonable." + "value": "Low severity, duration-based acceptance is reasonable." } ] }, @@ -23229,7 +23229,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unscored severity with duration-based acceptance; low stakes." } ] }, @@ -23337,7 +23337,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unscored severity with duration-based acceptance; low stakes." } ] }, @@ -23447,7 +23447,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -23557,7 +23557,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -23667,7 +23667,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -23775,7 +23775,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded for bootstrap; safe as-is." } ] }, @@ -23883,7 +23883,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -23991,7 +23991,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -24099,7 +24099,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -24207,7 +24207,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -24315,7 +24315,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -24423,7 +24423,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 of 286 classes loaded for junit (test-scope dependency); safe as-is." } ] }, @@ -24531,7 +24531,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable on commons-lang3, structural fact, safe as-is." + "value": "code_not_reachable, 0 of 152 classes loaded for commons-lang3 (separate component from commons-lang above); safe as-is." } ] }, @@ -24639,7 +24639,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable on commons-lang3, structural fact, safe as-is." + "value": "code_not_reachable, 0 of 152 classes loaded for commons-lang3 (separate component from commons-lang above); safe as-is." } ] }, @@ -24749,7 +24749,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -24859,7 +24859,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -24969,7 +24969,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable." } ] }, @@ -25079,7 +25079,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity on spring-context; duration-based acceptance reasonable." + "value": "Medium severity, duration-based acceptance is reasonable (spring-context instance)." } ] }, @@ -25189,7 +25189,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; duration-based acceptance reasonable." + "value": "Low severity, duration-based acceptance is reasonable." } ] }, @@ -25297,7 +25297,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 of 466 classes loaded for httpclient; safe as-is." } ] }, @@ -25405,7 +25405,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 of 110 classes loaded for commons-io; safe as-is." } ] }, @@ -25513,7 +25513,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural fact, safe as-is." + "value": "code_not_reachable, 0 classes loaded; safe as-is." } ] }, @@ -25623,7 +25623,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable." + "value": "Medium severity (4.0), duration-based acceptance is reasonable." } ] }, @@ -25731,7 +25731,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unscored severity, duration-based acceptance is reasonable; low stakes." } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index b010847..036a09a 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -510,13 +510,17 @@ private String generateReport(List appResults, List entrie sb.append("\n### Legend\n\n"); sb.append("**VEX** - `NA` = not_affected, `IT` = in_triage\n\n"); + sb.append("**Action:**\n\n"); + sb.append("| Action | Meaning |\n|--------|---------|\n"); + sb.append("| `Safe` | Structural justification (`UNU`/`SHD`) - trust the claim as-is regardless of severity |\n"); + sb.append("| `Monitor` | Duration-based justification (`AGD`/`WCH`), advisor assessed it as sound for now - keep watching |\n"); + sb.append("| `Review` | Flagged `needs_review` by the VEX Advisor - human should confirm before relying on it (see the app's Risk Rationale above) |\n\n"); sb.append("**Rationale code:**\n\n"); sb.append("| Code | Meaning |\n|------|---------|\n"); sb.append("| `UNU` | Unused - library never loaded at runtime (0 classes) |\n"); sb.append("| `SHD` | Shielded - CVE Shield/Protect actively mitigating at runtime |\n"); sb.append("| `AGD` | Aged out - not_affected on duration alone (no observed execution past the acceptance threshold) |\n"); sb.append("| `WCH` | Watching - in_triage, still within the acceptance window |\n"); - sb.append("| `!` suffix | Flagged `needs_review` by the VEX Advisor - see the app's Risk Rationale above |\n"); sb.append("\n---\n\n## Application Detail\n\n"); @@ -541,11 +545,12 @@ private String generateReport(List appResults, List entrie Map statementAssessments = assessmentsByApp.getOrDefault(appName, Map.of()); if (entry != null) { + List actionOrder = java.util.Arrays.asList("Review", "Monitor", "Safe"); List statements = new ArrayList<>(entry.statements); statements.sort((a, b) -> { - boolean aFlagged = isFlagged(statementAssessments, a); - boolean bFlagged = isFlagged(statementAssessments, b); - if (aFlagged != bFlagged) return aFlagged ? -1 : 1; + int aAction = actionOrder.indexOf(action(statementAssessments, a)); + int bAction = actionOrder.indexOf(action(statementAssessments, b)); + if (aAction != bAction) return Integer.compare(aAction, bAction); int aSev = severityOrder.indexOf(a.severity != null ? a.severity.toLowerCase() : "unknown"); int bSev = severityOrder.indexOf(b.severity != null ? b.severity.toLowerCase() : "unknown"); if (aSev < 0) aSev = severityOrder.size(); @@ -553,13 +558,13 @@ private String generateReport(List appResults, List entrie return Integer.compare(aSev, bSev); }); - sb.append("| CVE | Library | Score | VEX | Rationale |\n|-----|---------|-------|-----|-----------|\n"); + sb.append("| CVE | Library | Score | VEX | Action | Rationale |\n|-----|---------|-------|-----|--------|-----------|\n"); for (VexStatement s : statements) { - boolean flagged = isFlagged(statementAssessments, s); sb.append("| ").append(s.cveId).append(" | ").append(plainLibrary(s.purl)) .append(" | ").append(s.score != null ? s.score : "-").append(" | ") .append("in_triage".equals(s.state) ? "IT" : "NA").append(" | ") - .append(rationaleCode(s)).append(flagged ? "!" : "").append(" |\n"); + .append(action(statementAssessments, s)).append(" | ") + .append(rationaleCode(s)).append(" |\n"); } sb.append("\n"); } @@ -571,10 +576,11 @@ private String generateReport(List appResults, List entrie sb.append("VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and ") .append("per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This ") .append("advisor does not change any claim; it only assesses whether relying on each claim as generated is ") - .append("reasonable given the CVE's severity and exploitability. See the Legend above for the VEX/Rationale ") + .append("reasonable given the CVE's severity and exploitability. See the Legend above for the Action/VEX/Rationale ") .append("codes used in the per-application tables.\n\n"); - sb.append("- **sound** (no `!`): the claim's justification (structural fact or active control) supports relying on it as-is\n"); - sb.append("- **needs_review** (`!` suffix): the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or ") + sb.append("- **Safe/Monitor** (sound): the claim's justification supports relying on it as-is - Safe is structural ") + .append("(the library is unused or an active control is mitigating it), Monitor is duration-based but currently well within reason\n"); + sb.append("- **Review** (needs_review): the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or ") .append("is otherwise borderline - a human should confirm before treating it as resolved\n\n---\n\n"); sb.append("*Report generated by Contrast VEX Advisor*\n*Powered by Contrast Security Runtime Observability*\n"); @@ -586,6 +592,13 @@ private boolean isFlagged(Map statementAssessments, VexState return assessment != null && "needs_review".equals(getString(assessment, "assessment", "")); } + /** Safe = structural (UNU/SHD); Monitor = duration-based but assessed sound; Review = flagged needs_review. */ + private String action(Map statementAssessments, VexStatement s) { + if (isFlagged(statementAssessments, s)) return "Review"; + String code = rationaleCode(s); + return ("UNU".equals(code) || "SHD".equals(code)) ? "Safe" : "Monitor"; + } + /** UNU/SHD structural justifications are always sound; AGD/WCH are duration-based and may be flagged. */ private String rationaleCode(VexStatement s) { if ("code_not_reachable".equals(s.justification)) return "UNU"; From c35228f95d774452eae9b94caba0e4d45cfddb6d Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 20:33:28 -0400 Subject: [PATCH 08/16] Bump GitHub Actions to Node 24-native versions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit actions/checkout v4->v5, actions/setup-java v4->v5, actions/upload-artifact v4->v5 - resolves the Node.js 20 deprecation warning (v4 actions were being forced onto Node 24) and the setup-java v4 deprecation notice. 🤖 Generated with Claude Code --- .github/workflows/build.yml | 6 +++--- .github/workflows/release.yml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e27db24..ffbdc27 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -10,10 +10,10 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: '17' distribution: 'temurin' @@ -23,7 +23,7 @@ jobs: run: mvn clean package - name: Upload jar artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: name: runtime-analyst-jar path: target/runtime-analyst-*.jar diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2c80f5f..f6ed359 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,10 +12,10 @@ jobs: build-and-release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: '17' distribution: 'temurin' From 513d73670600e710a1d805243c3092079ffae7e6 Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 21:32:57 -0400 Subject: [PATCH 09/16] Spell out Rationale, add day counts, drop the Action column Rationale is now one full word instead of a 3-letter code, and the two duration-based reasons carry their day count: Unused, Shielded, Aged 288d, Watching 12d (using daysObserved, already parsed onto VexStatement but previously unused in the table). Removed the Action column (Safe/Monitor/Review) added last commit. Review and Monitor turned out to prescribe no distinct action - both mean "look at it or consider upgrading," and there's nothing concrete a reviewer can do to "confirm" a duration-based claim beyond what the per-app Recommendation text already says. Rather than a column that implies a decision framework it doesn't back up, rows now sort by actual risk signal instead: CISA KEV-listed first, then EPSS score, then CVSS score - so the claims worth a second look surface at the top, and the Key Findings section already names which specific CVEs those are. Regenerated samples/sample-vex.json and sample-vex-advisor.md against SAML-PetClinic-Demo. --- README.md | 2 +- samples/sample-vex-advisor.md | 522 +++++++++--------- samples/sample-vex.json | 472 ++++++++-------- .../runtimeanalyst/VEXAdvisor.java | 80 ++- 4 files changed, 526 insertions(+), 550 deletions(-) diff --git a/README.md b/README.md index 612a1ff..e7e62ae 100644 --- a/README.md +++ b/README.md @@ -221,7 +221,7 @@ Note: `PROTECTED_AT_RUNTIME` (CVE Shield/Protect actively mitigating) is impleme - **Quantum Advisor** - findings grouped by risk level (CRITICAL/HIGH/MEDIUM/LOW/NOT_QUANTUM_ISSUE), with an "Application Context" section describing each app from its architecture graph data - **AI Advisor** - organized as an inventory of AI-enabled applications (one section per app, not per finding): an AI-generated description of what the app does, then each AI usage instance with model/provider/endpoint and a description of what that specific call is doing, inferred from the key methods around it in the stack trace -- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Action | Rationale`) using short codes - `Action` is `Safe`/`Monitor`/`Review`, `Rationale` is `UNU`/`SHD`/`AGD`/`WCH` - decoded in a legend, rather than a full-sentence rationale repeated per claim. +- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Rationale`, e.g. `Aged 288d` or `Unused` - decoded in a legend) instead of a full-sentence rationale repeated per claim. Rows sort CISA KEV-listed first, then by EPSS, then by CVSS score, so the claims worth a second look surface at the top without needing a separate flag column - there's no distinct action per severity tier (the real options, verify reachability or upgrade, are the same regardless), so the report doesn't pretend otherwise with a column that can't back it up. Both the Quantum and AI Advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component. The VEX Advisor writes `contrast:vexAdvisorAssessment` (`sound`/`needs_review`) and `contrast:vexAdvisorRationale` back onto each vulnerability's `properties[]`. All of this happens automatically as part of every `--analyze` run, no separate step needed. diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index 7c1c08f..af02123 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -27,32 +27,26 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated | Application | Risk Level | Statements | |-------------|------------|------------| -| SAML-PetClinic-Demo | HIGH | 235 | +| SAML-PetClinic-Demo | CRITICAL | 235 | | Risk Level | Applications | |------------|--------------| -| HIGH | 1 | +| CRITICAL | 1 | ### Legend **VEX** - `NA` = not_affected, `IT` = in_triage -**Action:** +**Rationale** - why the claim was made, with the day count for the two duration-based reasons: -| Action | Meaning | -|--------|---------| -| `Safe` | Structural justification (`UNU`/`SHD`) - trust the claim as-is regardless of severity | -| `Monitor` | Duration-based justification (`AGD`/`WCH`), advisor assessed it as sound for now - keep watching | -| `Review` | Flagged `needs_review` by the VEX Advisor - human should confirm before relying on it (see the app's Risk Rationale above) | +| Rationale | Meaning | +|-----------|---------| +| `Unused` | Library never loaded at runtime (0 classes) - structural, not time-based | +| `Shielded` | CVE Shield/Protect actively mitigating at runtime - an active control, not time-based | +| `Aged Nd` | not_affected on N days without observed execution alone, past the acceptance threshold | +| `Watching Nd` | in_triage - N days without observed execution so far, still short of the acceptance threshold | -**Rationale code:** - -| Code | Meaning | -|------|---------| -| `UNU` | Unused - library never loaded at runtime (0 classes) | -| `SHD` | Shielded - CVE Shield/Protect actively mitigating at runtime | -| `AGD` | Aged out - not_affected on duration alone (no observed execution past the acceptance threshold) | -| `WCH` | Watching - in_triage, still within the acceptance window | +Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth a second look surface at the top - see the Key Findings above for which specific CVEs those are. --- @@ -60,260 +54,260 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated ### SAML-PetClinic-Demo -**Risk Level:** HIGH - -SAML-PetClinic-Demo has 235 VEX claims across ~35 outdated libraries (jackson-databind 2.8.8, tomcat-embed-core 8.5.15, spring-web/webmvc/beans/core/context/expression 4.3.9, spring-data-commons, hibernate-core, and others). About 45% of claims rest on structural code_not_reachable evidence (0 classes loaded) and are sound as written. The remaining majority are duration-based not_affected claims (288 days observed, well past the 30-day threshold), and a large share of those cover critical or high severity CVEs, including several KEV-listed CVEs (CVE-2022-22965/Spring4Shell, CVE-2020-1938/Ghostcat, CVE-2017-12617, CVE-2023-44487, CVE-2018-1273, CVE-2025-24813), so those carry more residual risk than the claim language conveys. - -**Risk Rationale:** A large volume of not_affected claims on critical/high severity CVEs (roughly 130 of 235) rely solely on 288 days of no observed execution rather than structural non-reachability. This is a legitimate operational signal but a probabilistic one, and several of the affected libraries carry KEV-listed CVEs actively exploited in the wild (CVE-2022-22965 in spring-webmvc/spring-beans, CVE-2020-1938 and CVE-2017-12617 and CVE-2023-44487 and CVE-2025-24813 in tomcat-embed-core, CVE-2018-1273 in spring-data-commons). The jackson-databind 2.8.8 stack alone accounts for over 50 critical/high duration-based claims. None of these are individually unreasonable given 288 days > 30-day threshold, but the sheer concentration of critical/KEV exposure resting on absence-of-observation reasoning is the primary driver of the HIGH rating. - -**Recommendation:** Before relying on this VEX as-is, have a human re-verify the duration-based not_affected claims for the KEV-listed CVEs first (CVE-2022-22965 on spring-webmvc/spring-beans, CVE-2020-1938 and CVE-2017-12617 and CVE-2023-44487 and CVE-2025-24813 on tomcat-embed-core, CVE-2018-1273 on spring-data-commons), then spot-check the remaining critical-severity jackson-databind and tomcat-embed-core duration-based claims. The code_not_reachable claims (htmlunit, snakeyaml, netty, jetty-http, plexus-utils, commons-compress, bootstrap, junit, commons-lang/commons-lang3, httpclient, commons-io, neko-htmlunit) do not need re-review. Given how old and out-of-support most of these library versions are (Spring 4.x, Tomcat 8.5.15, Hibernate 5.0.4, jackson 2.8.8), an actual upgrade is the more durable fix rather than continuing to lean on runtime-absence reasoning. - -| CVE | Library | Score | VEX | Action | Rationale | -|-----|---------|-------|-----|--------|-----------| -| CVE-2018-14721 | jackson-databind@2.8.8 | 10.0 | NA | Review | AGD | -| CVE-2018-11307 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2017-17485 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2019-20330 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2018-14718 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2018-14719 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2020-9548 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2019-14540 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2020-9547 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2019-14892 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2018-19361 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2018-19360 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2018-19362 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2019-17267 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2017-7525 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2018-7489 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2019-17531 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | Review | AGD | -| CVE-2020-10683 | dom4j@1.6.1 | 9.8 | NA | Review | AGD | -| CVE-2022-22965 | spring-boot-starter-web@1.5.4.RELEASE | 9.8 | NA | Review | UNU | -| CVE-2018-1273 | spring-data-commons@1.13.4.RELEASE | 9.8 | NA | Review | AGD | -| CVE-2022-41853 | hsqldb@2.3.5 | 9.8 | NA | Review | AGD | -| CVE-2017-5929 | logback-core@1.1.11 | 9.8 | NA | Review | AGD | -| CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | Review | AGD | -| CVE-2022-22965 | spring-webmvc@4.3.9.RELEASE | 9.8 | NA | Review | AGD | -| CVE-2017-5929 | logback-classic@1.1.11 | 9.8 | NA | Review | AGD | -| CVE-2022-22965 | spring-beans@4.3.9.RELEASE | 9.8 | NA | Review | AGD | -| CVE-2018-8014 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | -| CVE-2025-24813 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | -| CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | -| CVE-2020-1938 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | -| CVE-2025-31651 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | -| CVE-2024-50379 | tomcat-embed-core@8.5.15 | 9.8 | NA | Review | AGD | -| CVE-2026-43515 | tomcat-embed-core@8.5.15 | 9.1 | NA | Review | AGD | -| CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Review | AGD | -| CVE-2026-40477 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Review | AGD | -| CVE-2026-40478 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Review | AGD | -| CVE-2020-10673 | jackson-databind@2.8.8 | 8.8 | NA | Review | AGD | -| CVE-2020-35728 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-35491 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-35490 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36184 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36182 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36180 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36186 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36181 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36179 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-10650 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36185 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36188 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36187 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36189 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-36183 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2021-20190 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2018-5968 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-24616 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2020-24750 | jackson-databind@2.8.8 | 8.1 | NA | Review | AGD | -| CVE-2022-42004 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | -| CVE-2022-42003 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | -| CVE-2020-25649 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | -| CVE-2018-12023 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | -| CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | -| CVE-2019-14439 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | -| CVE-2018-12022 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | -| CVE-2019-12086 | jackson-databind@2.8.8 | 7.5 | NA | Review | AGD | -| CVE-2018-1000632 | dom4j@1.6.1 | 7.5 | NA | Review | AGD | -| CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | Review | AGD | -| CVE-2024-22243 | spring-web@4.3.9.RELEASE | 8.1 | NA | Review | AGD | -| CVE-2024-22262 | spring-web@4.3.9.RELEASE | 8.1 | NA | Review | AGD | -| CVE-2024-22259 | spring-web@4.3.9.RELEASE | 8.1 | NA | Review | AGD | -| CVE-2026-41842 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2024-38819 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | Review | AGD | -| CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | Review | AGD | -| CVE-2017-12617 | tomcat-embed-core@8.5.15 | 8.1 | NA | Review | AGD | -| CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2018-8034 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2019-17563 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2023-46589 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2025-55752 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2026-43513 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2021-25122 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2025-48988 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2025-49125 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2025-53506 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2025-52520 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2025-31650 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2023-44487 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2018-1336 | tomcat-embed-core@8.5.15 | 7.5 | NA | Review | AGD | -| CVE-2025-46701 | tomcat-embed-core@8.5.15 | 7.3 | NA | Review | AGD | -| CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | Review | AGD | -| CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | Review | AGD | -| CVE-2020-9484 | tomcat-embed-core@8.5.15 | 7.0 | NA | Review | AGD | -| CVE-2018-3258 | mysql-connector-java@5.1.42 | 8.8 | NA | Review | AGD | -| CVE-2023-22102 | mysql-connector-java@5.1.42 | 8.3 | NA | Review | AGD | -| CVE-2022-27772 | spring-boot@1.5.4.RELEASE | 7.8 | NA | Review | AGD | -| CVE-2025-22235 | spring-boot@1.5.4.RELEASE | 7.3 | NA | Review | AGD | -| CVE-2026-40973 | spring-boot@1.5.4.RELEASE | 7.0 | NA | Review | AGD | -| CVE-2022-25647 | gson@2.8.0 | 7.5 | NA | Review | AGD | -| CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | Review | AGD | -| CVE-2018-1272 | spring-core@4.3.9.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2026-41848 | spring-core@4.3.9.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2018-11040 | spring-core@4.3.9.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2026-41850 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2026-41851 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2026-41849 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | Review | AGD | -| CVE-2020-25638 | hibernate-core@5.0.4.Final | 7.4 | NA | Review | AGD | -| CVE-2017-7536 | hibernate-validator@5.3.5.Final | 7.0 | NA | Review | AGD | -| CVE-2023-2976 | guava@19.0 | 7.1 | NA | Review | AGD | -| CVE-2019-12384 | jackson-databind@2.8.8 | 5.9 | NA | Monitor | AGD | -| CVE-2019-12814 | jackson-databind@2.8.8 | 5.9 | NA | Monitor | AGD | -| CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Monitor | AGD | -| CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Monitor | AGD | -| CVE-2021-42550 | logback-core@1.1.11 | 6.6 | NA | Monitor | AGD | -| CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | Monitor | AGD | -| CVE-2024-38820 | spring-web@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2024-38809 | spring-web@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Monitor | AGD | -| CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Monitor | AGD | -| CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Monitor | AGD | -| CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Monitor | AGD | -| CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Monitor | AGD | -| CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2018-1305 | tomcat-embed-core@8.5.15 | 6.5 | NA | Monitor | AGD | -| CVE-2019-0221 | tomcat-embed-core@8.5.15 | 6.1 | NA | Monitor | AGD | -| CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | Monitor | AGD | -| CVE-2018-8037 | tomcat-embed-core@8.5.15 | 5.9 | NA | Monitor | AGD | -| CVE-2018-1304 | tomcat-embed-core@8.5.15 | 5.9 | NA | Monitor | AGD | -| CVE-2025-61795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Monitor | AGD | -| CVE-2024-21733 | tomcat-embed-core@8.5.15 | 5.3 | NA | Monitor | AGD | -| CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Monitor | AGD | -| CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | Monitor | AGD | -| CVE-2019-2692 | mysql-connector-java@5.1.42 | 6.3 | NA | Monitor | AGD | -| CVE-2018-1196 | spring-boot@1.5.4.RELEASE | 5.9 | NA | Monitor | AGD | -| CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | Monitor | AGD | -| CVE-2018-1271 | spring-core@4.3.9.RELEASE | 5.9 | NA | Monitor | AGD | -| CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2021-22096 | spring-core@4.3.9.RELEASE | 4.3 | NA | Monitor | AGD | -| CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Monitor | AGD | -| CVE-2023-20861 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Monitor | AGD | -| CVE-2022-22950 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Monitor | AGD | -| CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2024-38808 | spring-expression@4.3.9.RELEASE | 4.3 | NA | Monitor | AGD | -| CVE-2024-23672 | tomcat-embed-websocket@8.5.15 | 6.3 | NA | Monitor | AGD | -| CVE-2019-14900 | hibernate-core@5.0.4.Final | 6.5 | NA | Monitor | AGD | -| CVE-2022-23437 | xercesimpl@2.11.0 | 6.5 | NA | Monitor | AGD | -| CVE-2020-14338 | xercesimpl@2.11.0 | 5.3 | NA | Monitor | AGD | -| CVE-2023-34055 | spring-boot-actuator@1.5.4.RELEASE | 6.5 | NA | Monitor | AGD | -| CVE-2019-3797 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2019-3802 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2024-38820 | spring-context@4.3.9.RELEASE | 5.3 | NA | Monitor | AGD | -| CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | Monitor | AGD | -| CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | Monitor | AGD | -| CVE-2020-8908 | guava@19.0 | 3.3 | NA | Monitor | AGD | -| CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | Monitor | AGD | -| CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | Monitor | AGD | -| CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | -| CVE-2026-1225 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | -| CVE-2026-9828 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | -| CVE-2025-11226 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | -| CVE-2024-12798 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | -| CVE-2024-12801 | logback-core@1.1.11 | 0.0 | NA | Monitor | AGD | -| CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | Monitor | AGD | -| CVE-2012-0881 | xercesimpl@2.11.0 | 0.0 | NA | Monitor | AGD | -| CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | Monitor | AGD | -| CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | Monitor | AGD | -| CVE-2023-26119 | htmlunit@2.21 | 9.8 | NA | Safe | UNU | -| CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Safe | UNU | -| CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Safe | UNU | -| CVE-2019-20445 | netty@3.5.7.Final | 9.1 | NA | Safe | UNU | -| CVE-2019-20444 | netty@3.5.7.Final | 9.1 | NA | Safe | UNU | -| CVE-2026-2332 | jetty-http@9.4.5.v20170502 | 9.1 | NA | Safe | UNU | -| CVE-2020-5529 | htmlunit@2.21 | 8.1 | NA | Safe | UNU | -| CVE-2022-25857 | snakeyaml@1.17 | 7.5 | NA | Safe | UNU | -| CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Safe | UNU | -| CVE-2025-67030 | plexus-utils@3.0.8 | 8.8 | NA | Safe | UNU | -| CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Safe | UNU | -| CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Safe | UNU | -| CVE-2021-37137 | netty@3.5.7.Final | 7.5 | NA | Safe | UNU | -| CVE-2019-16869 | netty@3.5.7.Final | 7.5 | NA | Safe | UNU | -| CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Safe | UNU | -| CVE-2022-28366 | neko-htmlunit@2.21 | 7.5 | NA | Safe | UNU | -| CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Safe | UNU | -| CVE-2021-36090 | commons-compress@1.9 | 7.5 | NA | Safe | UNU | -| CVE-2021-35516 | commons-compress@1.9 | 7.5 | NA | Safe | UNU | -| CVE-2021-35517 | commons-compress@1.9 | 7.5 | NA | Safe | UNU | -| CVE-2021-35515 | commons-compress@1.9 | 7.5 | NA | Safe | UNU | -| CVE-2022-38749 | snakeyaml@1.17 | 6.5 | NA | Safe | UNU | -| CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Safe | UNU | -| CVE-2022-38751 | snakeyaml@1.17 | 6.5 | NA | Safe | UNU | -| CVE-2022-38752 | snakeyaml@1.17 | 6.5 | NA | Safe | UNU | -| CVE-2022-38750 | snakeyaml@1.17 | 5.5 | NA | Safe | UNU | -| CVE-2022-4245 | plexus-utils@3.0.8 | 4.3 | NA | Safe | UNU | -| CVE-2021-43797 | netty@3.5.7.Final | 6.5 | NA | Safe | UNU | -| CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Safe | UNU | -| CVE-2021-21295 | netty@3.5.7.Final | 5.9 | NA | Safe | UNU | -| CVE-2021-21290 | netty@3.5.7.Final | 5.5 | NA | Safe | UNU | -| CVE-2025-11143 | jetty-http@9.4.5.v20170502 | 6.5 | NA | Safe | UNU | -| CVE-2024-6763 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Safe | UNU | -| CVE-2023-40167 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Safe | UNU | -| CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Safe | UNU | -| CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Safe | UNU | -| CVE-2018-14042 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | -| CVE-2018-14040 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | -| CVE-2016-10735 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | -| CVE-2019-8331 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | -| CVE-2018-20677 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | -| CVE-2018-20676 | bootstrap@3.3.6 | 6.1 | NA | Safe | UNU | -| CVE-2020-15250 | junit@4.12 | 5.5 | NA | Safe | UNU | -| CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Safe | UNU | -| CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Safe | UNU | -| CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Safe | UNU | -| CVE-2021-29425 | commons-io@2.4 | 4.8 | NA | Safe | UNU | -| CVE-2024-47554 | commons-io@2.4 | 4.3 | NA | Safe | UNU | -| CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Safe | UNU | -| CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Safe | UNU | +**Risk Level:** CRITICAL + +SAML-PetClinic-Demo has 235 VEX claims covering a large, aging Java stack (jackson-databind 2.8.8, Spring Framework 4.3.9, spring-data-commons 1.13.4, Tomcat embed 8.5.15, and others). About 60 percent of the claims rest on code_not_reachable (zero classes loaded), which is sound. The remainder, roughly 90 claims, are not_affected determinations on critical or high severity CVEs justified only by 288 days without observed execution, including several KEV-listed remote code execution vulnerabilities in loaded libraries. + +**Risk Rationale:** Several KEV-listed critical RCEs, including Spring4Shell (CVE-2022-22965 in spring-webmvc and spring-beans, both of which have loaded classes) and spring-data-commons CVE-2018-1273, are marked not_affected purely on absence of observed execution rather than structural non-reachability. Tomcat's Ghostcat (CVE-2020-1938), Apache Struts style header smuggling (CVE-2017-12617), and CVE-2025-24813 carry the same weak justification on a widely-loaded, deeply used library (387 of 1481 classes). The jackson-databind 2.8.8 gadget-chain family (over 40 critical and high CVEs) is entirely excused this way as well. A 288 day observation window is comfortable against the 30 day threshold, but absence of evidence is a weak signal for CVEs this severe and this exploitable, so the overall reliability of this VEX file for critical and high findings is low. + +**Recommendation:** Have a human reviewer manually verify reachability (not just runtime absence) for the KEV-listed items first: CVE-2022-22965 on spring-webmvc and spring-beans, CVE-2018-1273 on spring-data-commons, CVE-2020-1938, CVE-2025-24813, CVE-2017-12617, and CVE-2023-44487 on tomcat-embed-core. After that, prioritize the jackson-databind critical CVEs, since the version is loaded and widely used (263 of 582 classes), before trusting this VEX file for a risk acceptance decision. The code_not_reachable claims (snakeyaml, netty, plexus-utils, jetty-http, bootstrap, commons-compress, commons-io, htmlunit, neko-htmlunit, junit, commons-lang, commons-lang3, httpclient, spring-boot-starter-web, spring-boot-starter-actuator) can be relied on as-is. + +| CVE | Library | Score | VEX | Rationale | +|-----|---------|-------|-----|-----------| +| CVE-2022-22965 | spring-boot-starter-web@1.5.4.RELEASE | 9.8 | NA | Unused | +| CVE-2022-22965 | spring-webmvc@4.3.9.RELEASE | 9.8 | NA | Aged 288d | +| CVE-2022-22965 | spring-beans@4.3.9.RELEASE | 9.8 | NA | Aged 288d | +| CVE-2025-24813 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | +| CVE-2017-12617 | tomcat-embed-core@8.5.15 | 8.1 | NA | Aged 288d | +| CVE-2023-44487 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2020-1938 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | +| CVE-2018-1273 | spring-data-commons@1.13.4.RELEASE | 9.8 | NA | Aged 288d | +| CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Unused | +| CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | Aged 288d | +| CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | Aged 288d | +| CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | Aged 288d | +| CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2025-55752 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2025-31650 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2025-48988 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2020-9484 | tomcat-embed-core@8.5.15 | 7.0 | NA | Aged 288d | +| CVE-2024-38819 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2017-17485 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2019-0221 | tomcat-embed-core@8.5.15 | 6.1 | NA | Aged 288d | +| CVE-2019-12384 | jackson-databind@2.8.8 | 5.9 | NA | Aged 288d | +| CVE-2024-50379 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | +| CVE-2017-7525 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2022-22950 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Aged 288d | +| CVE-2018-1271 | spring-core@4.3.9.RELEASE | 5.9 | NA | Aged 288d | +| CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | Aged 288d | +| CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Unused | +| CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | Aged 288d | +| CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | Aged 288d | +| CVE-2018-8014 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | +| CVE-2019-12086 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | +| CVE-2020-36179 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2018-8034 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2018-1336 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2018-7489 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2021-21295 | netty@3.5.7.Final | 5.9 | NA | Unused | +| CVE-2020-9548 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2020-9547 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2020-25649 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | +| CVE-2021-25122 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2018-1304 | tomcat-embed-core@8.5.15 | 5.9 | NA | Aged 288d | +| CVE-2012-0881 | xercesimpl@2.11.0 | 0.0 | NA | Aged 288d | +| CVE-2019-8331 | bootstrap@3.3.6 | 6.1 | NA | Unused | +| CVE-2018-1305 | tomcat-embed-core@8.5.15 | 6.5 | NA | Aged 288d | +| CVE-2024-21733 | tomcat-embed-core@8.5.15 | 5.3 | NA | Aged 288d | +| CVE-2018-14718 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2019-20445 | netty@3.5.7.Final | 9.1 | NA | Unused | +| CVE-2020-35728 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2021-36090 | commons-compress@1.9 | 7.5 | NA | Unused | +| CVE-2022-25647 | gson@2.8.0 | 7.5 | NA | Aged 288d | +| CVE-2021-35516 | commons-compress@1.9 | 7.5 | NA | Unused | +| CVE-2021-35515 | commons-compress@1.9 | 7.5 | NA | Unused | +| CVE-2022-23437 | xercesimpl@2.11.0 | 6.5 | NA | Aged 288d | +| CVE-2019-14540 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2018-19361 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2018-19360 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2018-19362 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2020-36188 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2019-14439 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | +| CVE-2019-17563 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2021-35517 | commons-compress@1.9 | 7.5 | NA | Unused | +| CVE-2019-12814 | jackson-databind@2.8.8 | 5.9 | NA | Aged 288d | +| CVE-2018-8037 | tomcat-embed-core@8.5.15 | 5.9 | NA | Aged 288d | +| CVE-2018-14721 | jackson-databind@2.8.8 | 10.0 | NA | Aged 288d | +| CVE-2018-14719 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2020-36184 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2021-29425 | commons-io@2.4 | 4.8 | NA | Unused | +| CVE-2019-20330 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2019-20444 | netty@3.5.7.Final | 9.1 | NA | Unused | +| CVE-2020-35491 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2020-24616 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2018-12023 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | +| CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | Aged 288d | +| CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Unused | +| CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2017-5929 | logback-core@1.1.11 | 9.8 | NA | Aged 288d | +| CVE-2017-5929 | logback-classic@1.1.11 | 9.8 | NA | Aged 288d | +| CVE-2020-10673 | jackson-databind@2.8.8 | 8.8 | NA | Aged 288d | +| CVE-2020-35490 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2019-16869 | netty@3.5.7.Final | 7.5 | NA | Unused | +| CVE-2020-10683 | dom4j@1.6.1 | 9.8 | NA | Aged 288d | +| CVE-2021-20190 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2018-5968 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2020-24750 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2018-12022 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | +| CVE-2018-1000632 | dom4j@1.6.1 | 7.5 | NA | Aged 288d | +| CVE-2021-37137 | netty@3.5.7.Final | 7.5 | NA | Unused | +| CVE-2018-11307 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2019-14892 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Unused | +| CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Unused | +| CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2019-17267 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2019-17531 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | +| CVE-2020-36182 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2020-36180 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2020-36186 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2020-36181 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2020-36185 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2020-36187 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2020-36189 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2020-36183 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2020-5529 | htmlunit@2.21 | 8.1 | NA | Unused | +| CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | +| CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Unused | +| CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Unused | +| CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | Aged 288d | +| CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Unused | +| CVE-2022-41853 | hsqldb@2.3.5 | 9.8 | NA | Aged 288d | +| CVE-2025-31651 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | +| CVE-2018-3258 | mysql-connector-java@5.1.42 | 8.8 | NA | Aged 288d | +| CVE-2024-22243 | spring-web@4.3.9.RELEASE | 8.1 | NA | Aged 288d | +| CVE-2021-42550 | logback-core@1.1.11 | 6.6 | NA | Aged 288d | +| CVE-2018-14042 | bootstrap@3.3.6 | 6.1 | NA | Unused | +| CVE-2018-14040 | bootstrap@3.3.6 | 6.1 | NA | Unused | +| CVE-2016-10735 | bootstrap@3.3.6 | 6.1 | NA | Unused | +| CVE-2018-20677 | bootstrap@3.3.6 | 6.1 | NA | Unused | +| CVE-2018-20676 | bootstrap@3.3.6 | 6.1 | NA | Unused | +| CVE-2023-26119 | htmlunit@2.21 | 9.8 | NA | Unused | +| CVE-2020-10650 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | +| CVE-2024-22259 | spring-web@4.3.9.RELEASE | 8.1 | NA | Aged 288d | +| CVE-2022-42004 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | +| CVE-2022-42003 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | +| CVE-2022-25857 | snakeyaml@1.17 | 7.5 | NA | Unused | +| CVE-2023-46589 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2025-49125 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2018-1272 | spring-core@4.3.9.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2018-11040 | spring-core@4.3.9.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2020-25638 | hibernate-core@5.0.4.Final | 7.4 | NA | Aged 288d | +| CVE-2025-46701 | tomcat-embed-core@8.5.15 | 7.3 | NA | Aged 288d | +| CVE-2022-38752 | snakeyaml@1.17 | 6.5 | NA | Unused | +| CVE-2021-43797 | netty@3.5.7.Final | 6.5 | NA | Unused | +| CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | Aged 288d | +| CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | Aged 288d | +| CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2025-53506 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2025-52520 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2022-28366 | neko-htmlunit@2.21 | 7.5 | NA | Unused | +| CVE-2022-38749 | snakeyaml@1.17 | 6.5 | NA | Unused | +| CVE-2022-38751 | snakeyaml@1.17 | 6.5 | NA | Unused | +| CVE-2019-14900 | hibernate-core@5.0.4.Final | 6.5 | NA | Aged 288d | +| CVE-2024-23672 | tomcat-embed-websocket@8.5.15 | 6.3 | NA | Aged 288d | +| CVE-2021-21290 | netty@3.5.7.Final | 5.5 | NA | Unused | +| CVE-2020-15250 | junit@4.12 | 5.5 | NA | Unused | +| CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Aged 288d | +| CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Unused | +| CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Unused | +| CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | +| CVE-2026-43515 | tomcat-embed-core@8.5.15 | 9.1 | NA | Aged 288d | +| CVE-2026-2332 | jetty-http@9.4.5.v20170502 | 9.1 | NA | Unused | +| CVE-2026-40477 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Aged 288d | +| CVE-2026-40478 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Aged 288d | +| CVE-2025-67030 | plexus-utils@3.0.8 | 8.8 | NA | Unused | +| CVE-2023-22102 | mysql-connector-java@5.1.42 | 8.3 | NA | Aged 288d | +| CVE-2024-22262 | spring-web@4.3.9.RELEASE | 8.1 | NA | Aged 288d | +| CVE-2022-27772 | spring-boot@1.5.4.RELEASE | 7.8 | NA | Aged 288d | +| CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | Aged 288d | +| CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | Aged 288d | +| CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Unused | +| CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Unused | +| CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | Aged 288d | +| CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Unused | +| CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Aged 288d | +| CVE-2023-20861 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Aged 288d | +| CVE-2023-34055 | spring-boot-actuator@1.5.4.RELEASE | 6.5 | NA | Aged 288d | +| CVE-2019-2692 | mysql-connector-java@5.1.42 | 6.3 | NA | Aged 288d | +| CVE-2018-1196 | spring-boot@1.5.4.RELEASE | 5.9 | NA | Aged 288d | +| CVE-2022-38750 | snakeyaml@1.17 | 5.5 | NA | Unused | +| CVE-2024-38820 | spring-web@4.3.9.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2024-38809 | spring-web@4.3.9.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2025-61795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Aged 288d | +| CVE-2024-6763 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Unused | +| CVE-2023-40167 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Unused | +| CVE-2020-14338 | xercesimpl@2.11.0 | 5.3 | NA | Aged 288d | +| CVE-2019-3797 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2019-3802 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2024-38820 | spring-context@4.3.9.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2022-4245 | plexus-utils@3.0.8 | 4.3 | NA | Unused | +| CVE-2021-22096 | spring-core@4.3.9.RELEASE | 4.3 | NA | Aged 288d | +| CVE-2024-38808 | spring-expression@4.3.9.RELEASE | 4.3 | NA | Aged 288d | +| CVE-2024-47554 | commons-io@2.4 | 4.3 | NA | Unused | +| CVE-2020-8908 | guava@19.0 | 3.3 | NA | Aged 288d | +| CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Unused | +| CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | Aged 288d | +| CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | Aged 288d | +| CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Aged 288d | +| CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Unused | +| CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2026-41842 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2026-43513 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | +| CVE-2026-41848 | spring-core@4.3.9.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2026-41850 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2026-41851 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2026-41849 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Aged 288d | +| CVE-2025-22235 | spring-boot@1.5.4.RELEASE | 7.3 | NA | Aged 288d | +| CVE-2023-2976 | guava@19.0 | 7.1 | NA | Aged 288d | +| CVE-2026-40973 | spring-boot@1.5.4.RELEASE | 7.0 | NA | Aged 288d | +| CVE-2017-7536 | hibernate-validator@5.3.5.Final | 7.0 | NA | Aged 288d | +| CVE-2025-11143 | jetty-http@9.4.5.v20170502 | 6.5 | NA | Unused | +| CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Aged 288d | +| CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Aged 288d | +| CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Aged 288d | +| CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Aged 288d | +| CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Aged 288d | +| CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Aged 288d | +| CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Aged 288d | +| CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Unused | +| CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | Aged 288d | +| CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | Aged 288d | +| CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | Aged 288d | +| CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | Aged 288d | +| CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | +| CVE-2026-1225 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | +| CVE-2026-9828 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | +| CVE-2025-11226 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | +| CVE-2024-12798 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | +| CVE-2024-12801 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | --- ## Appendix: Methodology -VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This advisor does not change any claim; it only assesses whether relying on each claim as generated is reasonable given the CVE's severity and exploitability. See the Legend above for the Action/VEX/Rationale codes used in the per-application tables. +VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This advisor does not change any claim; it only assesses whether relying on each claim as generated is reasonable given the CVE's severity and exploitability - it doesn't offer a distinct action per claim, since the real options (verify reachability, upgrade the library) are the same regardless of severity. See the Legend above for how the VEX/Rationale columns are derived, and the Key Findings above for which specific CVEs are CISA KEV-listed or high-EPSS. -- **Safe/Monitor** (sound): the claim's justification supports relying on it as-is - Safe is structural (the library is unused or an active control is mitigating it), Monitor is duration-based but currently well within reason -- **Review** (needs_review): the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or is otherwise borderline - a human should confirm before treating it as resolved +- **sound**: the claim's justification (structural fact or active control, or a duration comfortably past the threshold on a low-stakes CVE) supports relying on it as-is +- **needs_review**: the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or is otherwise borderline - a human should confirm before treating it as resolved --- diff --git a/samples/sample-vex.json b/samples/sample-vex.json index 5a9080c..818cbf7 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -3,7 +3,7 @@ "specVersion": "1.6", "version": 1, "metadata": { - "timestamp": "2026-09-03T00:29:08Z", + "timestamp": "2026-09-03T01:28:45Z", "component": { "type": "application", "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", @@ -117,7 +117,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (10.0) CVE on jackson-databind accepted purely on 288 days of non-execution, not structural reachability; absence-of-evidence is weak justification at this severity." + "value": "Critical severity jackson-databind gadget-chain CVE excused only by 288 days without observed execution in a library that is heavily loaded (263 of 582 classes), not by non-reachability." } ] }, @@ -227,7 +227,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) duration-only claim on a partially-loaded (263/582) library; worth a human check before relying on it." + "value": "Same duration-only reasoning on a critical CVE in a loaded jackson-databind, worth a manual reachability check before relying on it." } ] }, @@ -337,7 +337,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with high EPSS (0.5, 98.8th pct) accepted on runtime-absence alone; strong candidate for manual reachability review." + "value": "Critical CVE with a notably elevated EPSS score (0.5) accepted purely on absence of observed execution, a weaker signal given the exploitability." } ] }, @@ -447,7 +447,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8), high EPSS (97.9th pct); not_affected based only on 288 days without execution, not code_not_reachable." + "value": "Critical jackson-databind CVE with EPSS 0.27 relying only on duration, warrants review given how heavily the library is used." } ] }, @@ -557,7 +557,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity duration-based claim; library partially loaded so path could still exist unexercised." + "value": "Critical severity, duration-only justification on a heavily loaded gadget-chain-prone library." } ] }, @@ -667,7 +667,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity accepted solely on non-execution duration; should be reviewed given library is actively loaded." + "value": "Critical severity claim resting solely on absence of execution rather than reachability analysis." } ] }, @@ -777,7 +777,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical (9.8) duration-only justification; same jackson-databind deserialization family as other flagged CVEs." + "value": "Critical CVE justified only by runtime silence in a library with heavy class usage." } ] }, @@ -887,7 +887,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-based acceptance only; warrants review before trusting the claim." + "value": "Duration-only not_affected claim on a critical jackson-databind deserialization CVE." } ] }, @@ -997,7 +997,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-based acceptance only; part of the jackson-databind polymorphic deserialization CVE cluster." + "value": "Critical severity, no structural reachability guarantee, same jackson-databind gadget-chain family." } ] }, @@ -1107,7 +1107,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with elevated EPSS (97th pct); relies only on 288-day non-execution window." + "value": "Critical CVE with EPSS 0.18 accepted only on the basis of no observed execution." } ] }, @@ -1217,7 +1217,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity duration-based claim on a partially loaded library; not a structural guarantee." + "value": "Critical jackson-databind CVE, duration-only acceptance, worth confirming reachability." } ] }, @@ -1327,7 +1327,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, high EPSS (97th pct), duration-only justification." + "value": "Critical CVE with EPSS 0.18, absence-only reasoning, same underlying heavily-used library." } ] }, @@ -1437,7 +1437,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity accepted purely on non-execution; deserves manual reachability confirmation." + "value": "Critical severity claim relying only on runtime observation, not code-level non-reachability." } ] }, @@ -1547,7 +1547,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-based justification only." + "value": "Critical severity, duration-only acceptance in a heavily loaded library." } ] }, @@ -1657,7 +1657,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-based justification only, no structural reachability evidence." + "value": "Critical jackson-databind CVE excused only by absence of observed execution." } ] }, @@ -1767,7 +1767,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity duration-based claim; recommend human review." + "value": "Critical severity, no structural reachability finding, duration-only claim." } ] }, @@ -1877,7 +1877,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-based justification only." + "value": "Critical severity claim resting solely on 288 days of runtime silence." } ] }, @@ -1987,7 +1987,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-based justification only." + "value": "Critical CVE, duration-only not_affected claim in a widely used library." } ] }, @@ -2097,7 +2097,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity accepted on absence-of-observation alone." + "value": "Critical severity, absence-of-execution justification only, worth confirming." } ] }, @@ -2207,7 +2207,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with very high EPSS (98.8th pct); duration-only claim should not be trusted without review." + "value": "Critical CVE with an elevated EPSS score (0.38), duration-only acceptance is weaker evidence here." } ] }, @@ -2317,7 +2317,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, elevated EPSS (97th pct), duration-based justification only." + "value": "Critical severity, duration-only justification, worth manual confirmation." } ] }, @@ -2427,7 +2427,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity duration-based claim; warrants confirmation." + "value": "Critical CVE, no structural non-reachability guarantee, only runtime silence." } ] }, @@ -2537,7 +2537,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification, part of jackson-databind gadget-chain cluster." + "value": "Critical severity gadget-chain CVE accepted purely on absence of observed execution." } ] }, @@ -2647,7 +2647,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Critical severity, duration-only reasoning in a heavily used library." } ] }, @@ -2757,7 +2757,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity (8.8) accepted purely on non-execution duration rather than code_not_reachable." + "value": "High severity CVE excused only by 288 days without observed execution rather than reachability analysis." } ] }, @@ -2867,7 +2867,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on a partially loaded library." + "value": "High severity CVE accepted on duration alone in a heavily loaded library." } ] }, @@ -2977,7 +2977,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, same duration-only acceptance pattern across the jackson-databind gadget family." } ] }, @@ -3087,7 +3087,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE, absence-of-execution justification only." } ] }, @@ -3197,7 +3197,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, duration-only claim, worth confirming reachability." } ] }, @@ -3307,7 +3307,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE resting only on runtime silence." } ] }, @@ -3417,7 +3417,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, absence-of-execution justification, no code-level guarantee." } ] }, @@ -3527,7 +3527,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE, duration-only acceptance in a heavily used library." } ] }, @@ -3637,7 +3637,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, same duration-only pattern, worth review." } ] }, @@ -3747,7 +3747,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (97.4th pct); duration-only justification." + "value": "High severity CVE with EPSS 0.21, duration-only acceptance is a weaker signal." } ] }, @@ -3857,7 +3857,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, duration-only justification in a heavily loaded library." } ] }, @@ -3967,7 +3967,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE, absence-of-execution reasoning only." } ] }, @@ -4077,7 +4077,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, duration-only claim, worth confirming." } ] }, @@ -4187,7 +4187,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE excused only by runtime silence." } ] }, @@ -4297,7 +4297,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, same gadget-chain family, duration-only acceptance." } ] }, @@ -4407,7 +4407,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE, no structural non-reachability guarantee." } ] }, @@ -4517,7 +4517,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, duration-only justification, worth review." } ] }, @@ -4627,7 +4627,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE accepted purely on absence of observed execution." } ] }, @@ -4737,7 +4737,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, duration-only claim in a heavily loaded library." } ] }, @@ -4847,7 +4847,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE, no code-level reachability finding." } ] }, @@ -4957,7 +4957,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE (7.5), duration-only acceptance is a weaker basis for reliance." } ] }, @@ -5067,7 +5067,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, same duration-only reasoning as the paired CVE-2022-42004." } ] }, @@ -5177,7 +5177,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (97th pct); duration-only justification." + "value": "High severity CVE with EPSS 0.18, duration-only acceptance is weaker evidence." } ] }, @@ -5287,7 +5287,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, duration-only claim, worth manual confirmation." } ] }, @@ -5397,7 +5397,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE excused only by absence of observed execution." } ] }, @@ -5507,7 +5507,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity, duration-only reasoning in a heavily used library." } ] }, @@ -5617,7 +5617,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity CVE, no structural non-reachability guarantee." } ] }, @@ -5727,7 +5727,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (97.5th pct); duration-only justification." + "value": "High severity CVE with EPSS 0.22, duration-only acceptance warrants review." } ] }, @@ -5837,7 +5837,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity accepted on duration alone is acceptable; lower stakes if the reasoning is wrong." + "value": "Medium severity, lower stakes if the absence-of-execution reasoning is ever wrong, even though EPSS is elevated at 0.45." } ] }, @@ -5947,7 +5947,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity duration-based acceptance is reasonable." + "value": "Medium severity CVE accepted on duration, acceptable risk given the lower severity." } ] }, @@ -6055,7 +6055,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable with 0 of 1295 classes loaded is a structural fact, safe to rely on despite critical severity." + "value": "code_not_reachable with zero of 1295 classes loaded, a structural fact independent of severity." } ] }, @@ -6163,7 +6163,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; structural non-reachability holds regardless of severity." + "value": "code_not_reachable, zero classes loaded, safe to rely on regardless of high severity." } ] }, @@ -6273,7 +6273,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity (9.8) on dom4j accepted purely on duration despite the library being loaded (1/190 classes); needs review." + "value": "Critical severity CVE in dom4j accepted only on runtime silence, and the library does have one class loaded, so it is not a clean structural exclusion." } ] }, @@ -6383,7 +6383,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on a loaded library; worth confirming." + "value": "High severity dom4j CVE with duration-only justification, worth confirming." } ] }, @@ -6491,7 +6491,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 206 classes loaded; structural fact holds even though EPSS is maximal, since the library never loads at all." + "value": "code_not_reachable, zero of 206 classes loaded, structurally sound despite critical severity and very high EPSS (1.0)." } ] }, @@ -6599,7 +6599,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable justification, zero classes loaded, reliable regardless of severity." } ] }, @@ -6707,7 +6707,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, no snakeyaml classes ever loaded, a structural fact." } ] }, @@ -6815,7 +6815,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; low-stakes and structurally sound." + "value": "code_not_reachable, library never loaded, safe to trust." } ] }, @@ -6923,7 +6923,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, zero classes loaded, low risk to rely on." } ] }, @@ -7031,7 +7031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, structurally excluded library." } ] }, @@ -7139,7 +7139,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable justification is structural, not probabilistic." } ] }, @@ -7247,7 +7247,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, zero classes loaded, safe to rely on." } ] }, @@ -7355,7 +7355,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed Spring4Shell CVE on spring-beans accepted only via duration (202/408 classes loaded); high-priority for manual verification." + "value": "Spring4Shell against spring-beans, KEV-listed and critical, with 202 of 408 classes actively loaded, excused only by runtime silence. Needs manual verification." } ] }, @@ -7465,7 +7465,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, KEV-listed, extremely high EPSS (99.89th pct); accepted only on 288 days of non-execution against a loaded library (152/554 classes). This is the highest-priority claim to re-verify." + "value": "Critical, KEV-listed remote code execution CVE in spring-data-commons excused only by absence of observed execution in a heavily loaded library (152 of 554 classes). This is exactly the kind of claim that needs a human reachability check before relying on it." } ] }, @@ -7575,7 +7575,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim tied to the same spring-data-commons component as the KEV CVE-2018-1273; worth reviewing together." + "value": "High severity spring-data-commons CVE, duration-only acceptance, same library as the KEV entry above." } ] }, @@ -7685,7 +7685,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-only justification, though EPSS is very low; still worth a quick confirmation given the library is actively loaded." + "value": "High severity, duration-only justification, though EPSS is very low (near zero), worth a lighter-touch confirmation." } ] }, @@ -7795,7 +7795,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, duration-based acceptance is reasonable at this stakes level." + "value": "Medium severity, low EPSS, acceptable to rely on duration-based reasoning." } ] }, @@ -7905,7 +7905,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, duration-based acceptance is reasonable." + "value": "Medium severity CVE with very low EPSS, lower stakes." } ] }, @@ -8013,7 +8013,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unscored/effectively low stakes; duration-based acceptance is acceptable here." + "value": "Severity is unscored/unknown, lower stakes for a duration-only claim." } ] }, @@ -8123,7 +8123,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity (9.8) on hsqldb accepted purely on runtime-absence despite 229/601 classes loaded; needs review." + "value": "Critical severity hsqldb CVE excused only by absence of observed execution in a heavily loaded library (229 of 601 classes)." } ] }, @@ -8233,7 +8233,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity on logback-classic, duration-only justification despite meaningful class loading (63/178)." + "value": "Critical severity logback-classic CVE, duration-only claim in a loaded library (63 of 178 classes)." } ] }, @@ -8343,7 +8343,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on logback-classic; worth confirming." + "value": "High severity logback-classic CVE, absence-of-execution reasoning only." } ] }, @@ -8453,7 +8453,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable at this stakes level." + "value": "Medium severity, acceptable to rely on duration alone." } ] }, @@ -8561,7 +8561,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." + "value": "Unscored severity, low stakes for a duration-based claim." } ] }, @@ -8669,7 +8669,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." + "value": "Unscored severity, negligible EPSS, low stakes." } ] }, @@ -8777,7 +8777,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." + "value": "Unscored severity, low EPSS, acceptable as-is." } ] }, @@ -8885,7 +8885,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." + "value": "Unscored severity, negligible EPSS, low stakes." } ] }, @@ -8993,7 +8993,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." + "value": "Unscored severity, low stakes duration-based claim." } ] }, @@ -9101,7 +9101,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." + "value": "Unscored severity, negligible EPSS, acceptable as-is." } ] }, @@ -9211,7 +9211,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity (9.8) on spring-web with elevated EPSS (98.2nd pct); duration-only justification against a loaded library (211/559 classes)." + "value": "Critical severity spring-web CVE with EPSS 0.32, duration-only acceptance in a heavily loaded library (211 of 559 classes)." } ] }, @@ -9321,7 +9321,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-web; worth confirming." + "value": "High severity spring-web CVE, absence-of-execution reasoning only." } ] }, @@ -9431,7 +9431,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-web; worth confirming." + "value": "High severity, duration-only claim in a widely loaded library." } ] }, @@ -9541,7 +9541,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-web; worth confirming." + "value": "High severity CVE excused only by runtime silence." } ] }, @@ -9651,7 +9651,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable to rely on duration-based reasoning." } ] }, @@ -9761,7 +9761,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable (spring-context instance)." + "value": "Medium severity spring-context CVE, low stakes duration-based claim (separate library from the spring-web entry with the same CVE ID)." } ] }, @@ -9871,7 +9871,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable to trust the duration claim." } ] }, @@ -9981,7 +9981,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed Spring4Shell CVE on spring-beans accepted only via duration (202/408 classes loaded); high-priority for manual verification." + "value": "Spring4Shell against spring-beans, KEV-listed and critical, with 202 of 408 classes actively loaded, excused only by runtime silence. Needs manual verification." } ] }, @@ -10091,7 +10091,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-webmvc; worth confirming." + "value": "High severity spring-webmvc CVE, duration-only justification." } ] }, @@ -10201,7 +10201,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (98.95th pct); duration-only justification." + "value": "High severity CVE with an elevated EPSS score (0.55), duration-only acceptance is a weaker basis for reliance here." } ] }, @@ -10311,7 +10311,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low EPSS, acceptable duration-based claim." } ] }, @@ -10421,7 +10421,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, negligible EPSS, low stakes." } ] }, @@ -10531,7 +10531,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity CVE, acceptable to rely on as-is." } ] }, @@ -10641,7 +10641,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low EPSS, acceptable duration-based reasoning." } ] }, @@ -10751,7 +10751,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity CVE, low stakes." } ] }, @@ -10861,7 +10861,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, negligible EPSS, acceptable as-is." } ] }, @@ -10971,7 +10971,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low EPSS, acceptable to rely on." } ] }, @@ -11081,7 +11081,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; duration-based acceptance is safe." + "value": "Low severity, lowest stakes of the spring-webmvc claims." } ] }, @@ -11191,7 +11191,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity on logback-classic, duration-only justification despite meaningful class loading (63/178)." + "value": "Critical severity logback-classic CVE, duration-only claim in a loaded library (63 of 178 classes)." } ] }, @@ -11301,7 +11301,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on logback-classic; worth confirming." + "value": "High severity logback-classic CVE, absence-of-execution reasoning only." } ] }, @@ -11411,7 +11411,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed Spring4Shell CVE on spring-beans accepted only via duration (202/408 classes loaded); high-priority for manual verification." + "value": "Spring4Shell against spring-beans, KEV-listed and critical, with 202 of 408 classes actively loaded, excused only by runtime silence. Needs manual verification." } ] }, @@ -11521,7 +11521,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity spring-beans CVE, acceptable duration-based claim." } ] }, @@ -11631,7 +11631,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity on tomcat-embed-core, duration-only justification against a substantially loaded library (387/1481 classes)." + "value": "Critical severity tomcat-embed-core CVE, duration-only acceptance in a widely used library (387 of 1481 classes)." } ] }, @@ -11741,7 +11741,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed, EPSS near 1.0; accepted purely on runtime-absence. High-priority re-verification target." + "value": "Critical, KEV-listed RCE with a maximum EPSS score, excused only by absence of observed execution rather than reachability. This should be verified manually." } ] }, @@ -11851,7 +11851,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification on tomcat-embed-core." + "value": "Critical severity CVE, duration-only justification in a heavily loaded Tomcat library." } ] }, @@ -11961,7 +11961,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed Ghostcat vulnerability with EPSS 0.99; accepted purely on non-execution duration. High-priority re-verification target." + "value": "The Ghostcat CVE, KEV-listed and critical with EPSS 0.99, is accepted only on runtime silence, not code-level non-reachability. Warrants manual review." } ] }, @@ -12071,7 +12071,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification on tomcat-embed-core." + "value": "Critical severity CVE, duration-only claim in a widely-used library." } ] }, @@ -12181,7 +12181,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with elevated EPSS (98.7th pct); duration-only justification." + "value": "Critical severity CVE with an elevated EPSS score (0.44), duration-only acceptance is weaker evidence here." } ] }, @@ -12291,7 +12291,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification on tomcat-embed-core." + "value": "Critical severity CVE, duration-only justification, worth confirming." } ] }, @@ -12401,7 +12401,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with maximal EPSS (99.95th pct); duration-only justification." + "value": "High severity CVE with a maximum EPSS score of 1.0, excused only by absence of observed execution." } ] }, @@ -12511,7 +12511,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, KEV-listed, EPSS near max; accepted purely on runtime-absence despite active library loading. High-priority re-verification target." + "value": "KEV-listed high severity RCE with EPSS 1.0, accepted only on runtime silence. Should be manually verified." } ] }, @@ -12621,7 +12621,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (99.4th pct); duration-only justification." + "value": "High severity CVE with EPSS 0.73, duration-only acceptance is weaker evidence for a CVE this exploitable." } ] }, @@ -12731,7 +12731,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, duration-only claim in a heavily loaded library." } ] }, @@ -12841,7 +12841,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE excused only by absence of observed execution." } ] }, @@ -12951,7 +12951,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, no code-level reachability finding, worth review." } ] }, @@ -13061,7 +13061,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (99.2nd pct); duration-only justification." + "value": "High severity CVE with an elevated EPSS (0.67), duration-only acceptance is weaker evidence." } ] }, @@ -13171,7 +13171,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, duration-only justification, worth confirming reachability." } ] }, @@ -13281,7 +13281,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (99.4th pct); duration-only justification." + "value": "High severity CVE with EPSS 0.73, absence-of-execution justification only." } ] }, @@ -13391,7 +13391,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, duration-only reasoning in a heavily used library." } ] }, @@ -13501,7 +13501,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE excused only by 288 days without observed execution." } ] }, @@ -13611,7 +13611,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, no structural non-reachability guarantee." } ] }, @@ -13721,7 +13721,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (99th pct); duration-only justification." + "value": "High severity CVE with an elevated EPSS (0.57), duration-only acceptance warrants review." } ] }, @@ -13831,7 +13831,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, duration-only justification." } ] }, @@ -13941,7 +13941,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, absence-of-execution reasoning only." } ] }, @@ -14051,7 +14051,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, duration-only claim, worth confirming." } ] }, @@ -14161,7 +14161,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE excused only by runtime silence." } ] }, @@ -14271,7 +14271,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, duration-only reasoning in a widely used library." } ] }, @@ -14381,7 +14381,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (99.1st pct); duration-only justification." + "value": "High severity CVE with an elevated EPSS (0.6), duration-only acceptance is weaker evidence." } ] }, @@ -14491,7 +14491,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, no structural reachability finding." } ] }, @@ -14601,7 +14601,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, KEV-listed (HTTP/2 Rapid Reset), EPSS 1.0; accepted purely on non-execution duration. High-priority re-verification target." + "value": "KEV-listed HTTP/2 Rapid Reset CVE with EPSS at the maximum, excused only by absence of observed execution. Needs manual verification." } ] }, @@ -14711,7 +14711,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, duration-only justification." } ] }, @@ -14821,7 +14821,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE (7.3), absence-of-execution reasoning only." } ] }, @@ -14931,7 +14931,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE (7.0), duration-only claim in a heavily used library." } ] }, @@ -15041,7 +15041,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on tomcat-embed-core." + "value": "High severity CVE, no code-level reachability finding." } ] }, @@ -15151,7 +15151,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (99th pct); duration-only justification." + "value": "High severity CVE with an elevated EPSS (0.57), duration-only acceptance warrants review." } ] }, @@ -15261,7 +15261,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable duration-based claim." } ] }, @@ -15371,7 +15371,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, lower stakes despite an elevated EPSS of 0.46." } ] }, @@ -15481,7 +15481,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable to rely on duration alone." } ] }, @@ -15591,7 +15591,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity CVE, low stakes." } ] }, @@ -15701,7 +15701,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable duration-based reasoning." } ] }, @@ -15811,7 +15811,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low EPSS, low stakes." } ] }, @@ -15921,7 +15921,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity CVE, acceptable as-is." } ] }, @@ -16031,7 +16031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low EPSS, acceptable duration-based claim." } ] }, @@ -16141,7 +16141,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Classified medium severity despite a very high EPSS (0.94), so the lower CVSS score keeps the operational stakes lower even though this one is worth a spot check given the EPSS." } ] }, @@ -16249,7 +16249,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 102 classes loaded; structural fact holds regardless of critical severity." + "value": "code_not_reachable, zero of 102 classes loaded, structural fact regardless of critical severity." } ] }, @@ -16357,7 +16357,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, plexus-utils never loaded, safe to rely on." } ] }, @@ -16465,7 +16465,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, structural exclusion." } ] }, @@ -16573,7 +16573,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, low severity and structurally excluded." } ] }, @@ -16681,7 +16681,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 727 classes loaded for netty; structural fact holds regardless of severity." + "value": "code_not_reachable, zero of 727 netty classes loaded, structural fact despite critical severity." } ] }, @@ -16789,7 +16789,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, netty never loaded, safe to trust." } ] }, @@ -16897,7 +16897,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, structurally excluded library." } ] }, @@ -17005,7 +17005,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, zero classes loaded." } ] }, @@ -17113,7 +17113,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, safe regardless of severity." } ] }, @@ -17221,7 +17221,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, netty never loaded." } ] }, @@ -17329,7 +17329,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, structural exclusion." } ] }, @@ -17437,7 +17437,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, zero classes loaded, reliable." } ] }, @@ -17545,7 +17545,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, safe to trust." } ] }, @@ -17651,7 +17651,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and unscored severity; safe as-is." + "value": "code_not_reachable, unscored severity, structurally excluded." } ] }, @@ -17759,7 +17759,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 81 classes loaded for jetty-http; structural fact holds despite critical severity." + "value": "code_not_reachable, zero of 81 jetty-http classes loaded, structural fact despite critical severity." } ] }, @@ -17867,7 +17867,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, safe to rely on." } ] }, @@ -17975,7 +17975,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, jetty-http never loaded." } ] }, @@ -18083,7 +18083,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, structurally excluded." } ] }, @@ -18191,7 +18191,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and low severity; safe as-is." + "value": "code_not_reachable, low severity and structurally excluded." } ] }, @@ -18301,7 +18301,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity (9.0) on thymeleaf accepted purely on duration despite significant class loading (367/549); worth confirming." + "value": "Critical severity thymeleaf CVE, duration-only acceptance in a heavily used library (367 of 549 classes)." } ] }, @@ -18411,7 +18411,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification on thymeleaf." + "value": "Critical severity CVE, same duration-only reasoning, same widely loaded library." } ] }, @@ -18521,7 +18521,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification on thymeleaf." + "value": "Critical severity CVE, absence-of-execution justification only." } ] }, @@ -18631,7 +18631,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity (8.8) duration-based claim on mysql-connector-java; only 4 of 347 classes loaded, so worth confirming which classes are actually exercised." + "value": "High severity mysql-connector-java CVE, duration-only claim." } ] }, @@ -18741,7 +18741,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on mysql-connector-java; worth confirming." + "value": "High severity CVE, absence-of-execution reasoning only." } ] }, @@ -18851,7 +18851,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable duration-based claim." } ] }, @@ -18959,7 +18959,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored/low-stakes CVE; duration-based acceptance is fine." + "value": "Unscored severity, low stakes." } ] }, @@ -19067,7 +19067,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 0 classes loaded; structural fact holds despite high severity." + "value": "code_not_reachable, zero of zero classes loaded, structural fact despite high severity." } ] }, @@ -19177,7 +19177,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-boot; worth confirming." + "value": "High severity spring-boot CVE, duration-only acceptance in a loaded library (183 of 458 classes)." } ] }, @@ -19287,7 +19287,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-boot; worth confirming." + "value": "High severity CVE, no structural reachability finding." } ] }, @@ -19397,7 +19397,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-boot; worth confirming." + "value": "High severity CVE, duration-only justification, though EPSS is very low." } ] }, @@ -19507,7 +19507,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable to rely on duration-based reasoning." } ] }, @@ -19615,7 +19615,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 53 classes loaded for neko-htmlunit; safe as-is." + "value": "code_not_reachable, zero of 53 classes loaded, structural fact." } ] }, @@ -19723,7 +19723,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, neko-htmlunit never loaded." } ] }, @@ -19833,7 +19833,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on gson with partial class loading (36/174); worth confirming." + "value": "High severity gson CVE with EPSS 0.12, duration-only acceptance in a loaded library (36 of 174 classes)." } ] }, @@ -19941,7 +19941,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 200 classes loaded for commons-compress; structural fact holds despite high severity." + "value": "code_not_reachable, zero of 200 commons-compress classes loaded, structural fact despite high severity." } ] }, @@ -20049,7 +20049,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, structurally excluded library." } ] }, @@ -20157,7 +20157,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, safe to trust." } ] }, @@ -20265,7 +20265,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, zero classes loaded." } ] }, @@ -20373,7 +20373,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, low severity and structurally excluded." } ] }, @@ -20481,7 +20481,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable and medium severity; safe as-is." + "value": "code_not_reachable, medium severity and structurally excluded." } ] }, @@ -20591,7 +20591,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with high EPSS (0.81, 99.6th pct) on xalan; accepted on duration alone despite 7/1501 classes being loaded. Worth confirming which classes execute." + "value": "High severity xalan CVE with a notably elevated EPSS score (0.81), duration-only acceptance is weak here even though only 7 of 1501 classes are loaded, since it is still non-zero usage." } ] }, @@ -20701,7 +20701,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-core; worth confirming given substantial class loading (334/791)." + "value": "High severity spring-core CVE, duration-only claim in a heavily loaded library (334 of 791 classes)." } ] }, @@ -20811,7 +20811,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-core; worth confirming." + "value": "High severity CVE, absence-of-execution reasoning only." } ] }, @@ -20921,7 +20921,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-core; worth confirming." + "value": "High severity CVE, duration-only justification, though EPSS is negligible." } ] }, @@ -21031,7 +21031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-core; worth confirming." + "value": "High severity CVE, no code-level reachability finding." } ] }, @@ -21141,7 +21141,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable duration-based claim." } ] }, @@ -21251,7 +21251,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable despite moderate EPSS." + "value": "Medium severity, lower stakes despite an elevated EPSS of 0.35." } ] }, @@ -21361,7 +21361,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable to rely on as-is." } ] }, @@ -21471,7 +21471,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low EPSS, low stakes." } ] }, @@ -21581,7 +21581,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-expression; worth confirming." + "value": "High severity spring-expression CVE, duration-only acceptance in a heavily used library (91 of 142 classes)." } ] }, @@ -21691,7 +21691,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-expression; worth confirming." + "value": "High severity CVE, same duration-only reasoning." } ] }, @@ -21801,7 +21801,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-expression; worth confirming." + "value": "High severity CVE, absence-of-execution justification only." } ] }, @@ -21911,7 +21911,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable duration-based claim." } ] }, @@ -22021,7 +22021,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low stakes." } ] }, @@ -22131,7 +22131,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable despite moderate EPSS." + "value": "Medium severity, elevated EPSS of 0.36 but lower CVSS keeps stakes manageable." } ] }, @@ -22241,7 +22241,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low EPSS, acceptable as-is." } ] }, @@ -22351,7 +22351,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low stakes for a duration-based claim." } ] }, @@ -22461,7 +22461,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on spring-boot-autoconfigure; worth confirming." + "value": "High severity spring-boot-autoconfigure CVE, duration-only acceptance in a heavily loaded library (195 of 848 classes)." } ] }, @@ -22571,7 +22571,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity tomcat-embed-websocket CVE, acceptable duration-based reasoning." } ] }, @@ -22681,7 +22681,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on hibernate-core with heavy class loading (1563/3787); worth confirming." + "value": "High severity hibernate-core CVE, duration-only claim in an extremely heavily used library (1563 of 3787 classes)." } ] }, @@ -22791,7 +22791,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable to rely on as-is." } ] }, @@ -22901,7 +22901,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on hibernate-validator; worth confirming." + "value": "High severity hibernate-validator CVE, duration-only acceptance in a loaded library (225 of 459 classes)." } ] }, @@ -23011,7 +23011,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity duration-based claim on guava; worth confirming." + "value": "High severity guava CVE (7.1), duration-only justification, though EPSS is low." } ] }, @@ -23121,7 +23121,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, duration-based acceptance is reasonable." + "value": "Low severity, acceptable to rely on duration-based reasoning." } ] }, @@ -23229,7 +23229,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity with duration-based acceptance; low stakes." + "value": "Unscored severity, lower stakes despite an elevated EPSS of 0.17." } ] }, @@ -23337,7 +23337,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity with duration-based acceptance; low stakes." + "value": "Unscored severity, lower stakes despite an elevated EPSS of 0.25." } ] }, @@ -23447,7 +23447,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, acceptable duration-based claim." } ] }, @@ -23557,7 +23557,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low stakes." } ] }, @@ -23667,7 +23667,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity spring-boot-actuator CVE, acceptable duration-based reasoning." } ] }, @@ -23775,7 +23775,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded for bootstrap; safe as-is." + "value": "code_not_reachable, zero of zero classes loaded, structural fact." } ] }, @@ -23883,7 +23883,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, bootstrap never loaded." } ] }, @@ -23991,7 +23991,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, structurally excluded." } ] }, @@ -24099,7 +24099,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, safe to trust regardless of elevated EPSS (0.16)." } ] }, @@ -24207,7 +24207,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, structurally excluded library." } ] }, @@ -24315,7 +24315,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, safe to rely on." } ] }, @@ -24423,7 +24423,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 286 classes loaded for junit (test-scope dependency); safe as-is." + "value": "code_not_reachable, junit never loaded, a test-scope dependency with no runtime path anyway." } ] }, @@ -24531,7 +24531,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 152 classes loaded for commons-lang3 (separate component from commons-lang above); safe as-is." + "value": "code_not_reachable for commons-lang3, zero of 152 classes loaded, structurally sound (same CVE, separate library from the commons-lang entry above)." } ] }, @@ -24639,7 +24639,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 152 classes loaded for commons-lang3 (separate component from commons-lang above); safe as-is." + "value": "code_not_reachable for commons-lang3, zero of 152 classes loaded, structurally sound (same CVE, separate library from the commons-lang entry above)." } ] }, @@ -24749,7 +24749,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity spring-data-jpa CVE, acceptable duration-based claim." } ] }, @@ -24859,7 +24859,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity, low stakes." } ] }, @@ -24969,7 +24969,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable." + "value": "Medium severity spring-context CVE, acceptable to rely on as-is." } ] }, @@ -25079,7 +25079,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-based acceptance is reasonable (spring-context instance)." + "value": "Medium severity spring-context CVE, low stakes duration-based claim (separate library from the spring-web entry with the same CVE ID)." } ] }, @@ -25189,7 +25189,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, duration-based acceptance is reasonable." + "value": "Low severity, lowest stakes of the spring-context claims." } ] }, @@ -25297,7 +25297,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 466 classes loaded for httpclient; safe as-is." + "value": "code_not_reachable, zero of 466 httpclient classes loaded, structural fact." } ] }, @@ -25405,7 +25405,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 110 classes loaded for commons-io; safe as-is." + "value": "code_not_reachable, commons-io never loaded, safe to rely on." } ] }, @@ -25513,7 +25513,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; safe as-is." + "value": "code_not_reachable, structurally excluded library." } ] }, @@ -25623,7 +25623,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity (4.0), duration-based acceptance is reasonable." + "value": "Medium severity jackson-core CVE, acceptable duration-based claim." } ] }, @@ -25731,7 +25731,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, duration-based acceptance is reasonable; low stakes." + "value": "Unscored severity, low stakes duration-based claim." } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index 036a09a..4285f38 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -510,17 +510,14 @@ private String generateReport(List appResults, List entrie sb.append("\n### Legend\n\n"); sb.append("**VEX** - `NA` = not_affected, `IT` = in_triage\n\n"); - sb.append("**Action:**\n\n"); - sb.append("| Action | Meaning |\n|--------|---------|\n"); - sb.append("| `Safe` | Structural justification (`UNU`/`SHD`) - trust the claim as-is regardless of severity |\n"); - sb.append("| `Monitor` | Duration-based justification (`AGD`/`WCH`), advisor assessed it as sound for now - keep watching |\n"); - sb.append("| `Review` | Flagged `needs_review` by the VEX Advisor - human should confirm before relying on it (see the app's Risk Rationale above) |\n\n"); - sb.append("**Rationale code:**\n\n"); - sb.append("| Code | Meaning |\n|------|---------|\n"); - sb.append("| `UNU` | Unused - library never loaded at runtime (0 classes) |\n"); - sb.append("| `SHD` | Shielded - CVE Shield/Protect actively mitigating at runtime |\n"); - sb.append("| `AGD` | Aged out - not_affected on duration alone (no observed execution past the acceptance threshold) |\n"); - sb.append("| `WCH` | Watching - in_triage, still within the acceptance window |\n"); + sb.append("**Rationale** - why the claim was made, with the day count for the two duration-based reasons:\n\n"); + sb.append("| Rationale | Meaning |\n|-----------|---------|\n"); + sb.append("| `Unused` | Library never loaded at runtime (0 classes) - structural, not time-based |\n"); + sb.append("| `Shielded` | CVE Shield/Protect actively mitigating at runtime - an active control, not time-based |\n"); + sb.append("| `Aged Nd` | not_affected on N days without observed execution alone, past the acceptance threshold |\n"); + sb.append("| `Watching Nd` | in_triage - N days without observed execution so far, still short of the acceptance threshold |\n\n"); + sb.append("Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth ") + .append("a second look surface at the top - see the Key Findings above for which specific CVEs those are.\n"); sb.append("\n---\n\n## Application Detail\n\n"); @@ -530,7 +527,6 @@ private String generateReport(List appResults, List entrie int idx = order.indexOf(getString(r, "risk_level", "UNKNOWN")); return idx < 0 ? 99 : idx; })); - List severityOrder = java.util.Arrays.asList("critical", "high", "medium", "low", "unknown"); for (JsonObject r : sortedResults) { String appName = getString(r, "application", "Unknown"); @@ -542,29 +538,25 @@ private String generateReport(List appResults, List entrie sb.append("**Risk Rationale:** ").append(getString(r, "risk_rationale", "Unknown")).append("\n\n"); sb.append("**Recommendation:** ").append(getString(r, "recommendation", "None")).append("\n\n"); - Map statementAssessments = assessmentsByApp.getOrDefault(appName, Map.of()); - if (entry != null) { - List actionOrder = java.util.Arrays.asList("Review", "Monitor", "Safe"); List statements = new ArrayList<>(entry.statements); statements.sort((a, b) -> { - int aAction = actionOrder.indexOf(action(statementAssessments, a)); - int bAction = actionOrder.indexOf(action(statementAssessments, b)); - if (aAction != bAction) return Integer.compare(aAction, bAction); - int aSev = severityOrder.indexOf(a.severity != null ? a.severity.toLowerCase() : "unknown"); - int bSev = severityOrder.indexOf(b.severity != null ? b.severity.toLowerCase() : "unknown"); - if (aSev < 0) aSev = severityOrder.size(); - if (bSev < 0) bSev = severityOrder.size(); - return Integer.compare(aSev, bSev); + boolean aKev = Boolean.TRUE.equals(a.cisaKev), bKev = Boolean.TRUE.equals(b.cisaKev); + if (aKev != bKev) return aKev ? -1 : 1; + double aEpss = a.epssScore != null ? a.epssScore : -1; + double bEpss = b.epssScore != null ? b.epssScore : -1; + if (aEpss != bEpss) return Double.compare(bEpss, aEpss); + double aScore = a.score != null ? a.score : -1; + double bScore = b.score != null ? b.score : -1; + return Double.compare(bScore, aScore); }); - sb.append("| CVE | Library | Score | VEX | Action | Rationale |\n|-----|---------|-------|-----|--------|-----------|\n"); + sb.append("| CVE | Library | Score | VEX | Rationale |\n|-----|---------|-------|-----|-----------|\n"); for (VexStatement s : statements) { sb.append("| ").append(s.cveId).append(" | ").append(plainLibrary(s.purl)) .append(" | ").append(s.score != null ? s.score : "-").append(" | ") .append("in_triage".equals(s.state) ? "IT" : "NA").append(" | ") - .append(action(statementAssessments, s)).append(" | ") - .append(rationaleCode(s)).append(" |\n"); + .append(rationaleWord(s)).append(" |\n"); } sb.append("\n"); } @@ -576,35 +568,25 @@ private String generateReport(List appResults, List entrie sb.append("VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and ") .append("per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This ") .append("advisor does not change any claim; it only assesses whether relying on each claim as generated is ") - .append("reasonable given the CVE's severity and exploitability. See the Legend above for the Action/VEX/Rationale ") - .append("codes used in the per-application tables.\n\n"); - sb.append("- **Safe/Monitor** (sound): the claim's justification supports relying on it as-is - Safe is structural ") - .append("(the library is unused or an active control is mitigating it), Monitor is duration-based but currently well within reason\n"); - sb.append("- **Review** (needs_review): the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or ") + .append("reasonable given the CVE's severity and exploitability - it doesn't offer a distinct action per ") + .append("claim, since the real options (verify reachability, upgrade the library) are the same regardless of ") + .append("severity. See the Legend above for how the VEX/Rationale columns are derived, and the Key Findings ") + .append("above for which specific CVEs are CISA KEV-listed or high-EPSS.\n\n"); + sb.append("- **sound**: the claim's justification (structural fact or active control, or a duration comfortably ") + .append("past the threshold on a low-stakes CVE) supports relying on it as-is\n"); + sb.append("- **needs_review**: the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or ") .append("is otherwise borderline - a human should confirm before treating it as resolved\n\n---\n\n"); sb.append("*Report generated by Contrast VEX Advisor*\n*Powered by Contrast Security Runtime Observability*\n"); return sb.toString(); } - private boolean isFlagged(Map statementAssessments, VexStatement s) { - JsonObject assessment = statementAssessments.get(s.cveId); - return assessment != null && "needs_review".equals(getString(assessment, "assessment", "")); - } - - /** Safe = structural (UNU/SHD); Monitor = duration-based but assessed sound; Review = flagged needs_review. */ - private String action(Map statementAssessments, VexStatement s) { - if (isFlagged(statementAssessments, s)) return "Review"; - String code = rationaleCode(s); - return ("UNU".equals(code) || "SHD".equals(code)) ? "Safe" : "Monitor"; - } - - /** UNU/SHD structural justifications are always sound; AGD/WCH are duration-based and may be flagged. */ - private String rationaleCode(VexStatement s) { - if ("code_not_reachable".equals(s.justification)) return "UNU"; - if ("protected_at_runtime".equals(s.justification)) return "SHD"; - if ("in_triage".equals(s.state)) return "WCH"; - return "AGD"; + /** Unused/Shielded are structural; Aged/Watching are duration-based and carry the day count. */ + private String rationaleWord(VexStatement s) { + if ("code_not_reachable".equals(s.justification)) return "Unused"; + if ("protected_at_runtime".equals(s.justification)) return "Shielded"; + if ("in_triage".equals(s.state)) return "Watching " + s.daysObserved + "d"; + return "Aged " + s.daysObserved + "d"; } /** Strips a purl down to "artifact@version" - drops the "pkg:maven//" prefix for a narrow column. */ From b34cf8c00609f054cfd7a09991b58cec740f87e5 Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 21:56:06 -0400 Subject: [PATCH 10/16] Clarify Rationale wording: Library Unused / CVE Shielded / CVE Not Used Nd / CVE Watching Nd "Aged Nd" read as generic staleness rather than what it actually means - zero observed executions of the vulnerable path over the full N-day monitoring window. Renamed to "CVE Not Used Nd", and aligned the other three labels to the same "Library ___" / "CVE ___" pattern for consistency: Library Unused, CVE Shielded, CVE Not Used Nd, CVE Watching Nd. Regenerated samples/sample-vex.json and sample-vex-advisor.md against SAML-PetClinic-Demo. --- README.md | 2 +- samples/sample-vex-advisor.md | 492 ++++++------- samples/sample-vex.json | 680 +++++++++--------- .../runtimeanalyst/VEXAdvisor.java | 18 +- 4 files changed, 596 insertions(+), 596 deletions(-) diff --git a/README.md b/README.md index e7e62ae..a814079 100644 --- a/README.md +++ b/README.md @@ -221,7 +221,7 @@ Note: `PROTECTED_AT_RUNTIME` (CVE Shield/Protect actively mitigating) is impleme - **Quantum Advisor** - findings grouped by risk level (CRITICAL/HIGH/MEDIUM/LOW/NOT_QUANTUM_ISSUE), with an "Application Context" section describing each app from its architecture graph data - **AI Advisor** - organized as an inventory of AI-enabled applications (one section per app, not per finding): an AI-generated description of what the app does, then each AI usage instance with model/provider/endpoint and a description of what that specific call is doing, inferred from the key methods around it in the stack trace -- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Rationale`, e.g. `Aged 288d` or `Unused` - decoded in a legend) instead of a full-sentence rationale repeated per claim. Rows sort CISA KEV-listed first, then by EPSS, then by CVSS score, so the claims worth a second look surface at the top without needing a separate flag column - there's no distinct action per severity tier (the real options, verify reachability or upgrade, are the same regardless), so the report doesn't pretend otherwise with a column that can't back it up. +- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Rationale`, e.g. `CVE Not Used 288d` or `Library Unused` - decoded in a legend) instead of a full-sentence rationale repeated per claim. Rows sort CISA KEV-listed first, then by EPSS, then by CVSS score, so the claims worth a second look surface at the top without needing a separate flag column - there's no distinct action per severity tier (the real options, verify reachability or upgrade, are the same regardless), so the report doesn't pretend otherwise with a column that can't back it up. Both the Quantum and AI Advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component. The VEX Advisor writes `contrast:vexAdvisorAssessment` (`sound`/`needs_review`) and `contrast:vexAdvisorRationale` back onto each vulnerability's `properties[]`. All of this happens automatically as part of every `--analyze` run, no separate step needed. diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index af02123..795f74a 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -18,7 +18,7 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated **Key Findings:** -- **125 of 235 claim(s) flagged for human review** before relying on them. +- **21 of 235 claim(s) flagged for human review** before relying on them. - **8 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. - **10 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+4 more). - Application(s) rated CRITICAL/HIGH risk: SAML-PetClinic-Demo. @@ -27,11 +27,11 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated | Application | Risk Level | Statements | |-------------|------------|------------| -| SAML-PetClinic-Demo | CRITICAL | 235 | +| SAML-PetClinic-Demo | HIGH | 235 | | Risk Level | Applications | |------------|--------------| -| CRITICAL | 1 | +| HIGH | 1 | ### Legend @@ -41,10 +41,10 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated | Rationale | Meaning | |-----------|---------| -| `Unused` | Library never loaded at runtime (0 classes) - structural, not time-based | -| `Shielded` | CVE Shield/Protect actively mitigating at runtime - an active control, not time-based | -| `Aged Nd` | not_affected on N days without observed execution alone, past the acceptance threshold | -| `Watching Nd` | in_triage - N days without observed execution so far, still short of the acceptance threshold | +| `Library Unused` | Library never loaded at runtime (0 classes) - structural, not time-based | +| `CVE Shielded` | CVE Shield/Protect actively mitigating at runtime - an active control, not time-based | +| `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold | +| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold | Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth a second look surface at the top - see the Key Findings above for which specific CVEs those are. @@ -54,251 +54,251 @@ Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, s ### SAML-PetClinic-Demo -**Risk Level:** CRITICAL +**Risk Level:** HIGH -SAML-PetClinic-Demo has 235 VEX claims covering a large, aging Java stack (jackson-databind 2.8.8, Spring Framework 4.3.9, spring-data-commons 1.13.4, Tomcat embed 8.5.15, and others). About 60 percent of the claims rest on code_not_reachable (zero classes loaded), which is sound. The remainder, roughly 90 claims, are not_affected determinations on critical or high severity CVEs justified only by 288 days without observed execution, including several KEV-listed remote code execution vulnerabilities in loaded libraries. +SAML-PetClinic-Demo carries roughly 300 VEX claims spanning ~40 libraries, almost entirely dev/qa/prod runtime data collected over 288 days (well past the 30-day acceptance threshold). The large majority are either structurally sound (code_not_reachable, zero classes loaded) or duration-based acceptances on CVEs with low exploitability signals, but a meaningful subset of duration-only claims sit on CRITICAL/HIGH CVEs with very high EPSS or CISA KEV status, which is a materially weaker basis for 'not_affected.' -**Risk Rationale:** Several KEV-listed critical RCEs, including Spring4Shell (CVE-2022-22965 in spring-webmvc and spring-beans, both of which have loaded classes) and spring-data-commons CVE-2018-1273, are marked not_affected purely on absence of observed execution rather than structural non-reachability. Tomcat's Ghostcat (CVE-2020-1938), Apache Struts style header smuggling (CVE-2017-12617), and CVE-2025-24813 carry the same weak justification on a widely-loaded, deeply used library (387 of 1481 classes). The jackson-databind 2.8.8 gadget-chain family (over 40 critical and high CVEs) is entirely excused this way as well. A 288 day observation window is comfortable against the 30 day threshold, but absence of evidence is a weak signal for CVEs this severe and this exploitable, so the overall reliability of this VEX file for critical and high findings is low. +**Risk Rationale:** 20 claims rely on 'absence of observed execution' alone to dismiss CVEs that are either in the CISA KEV catalog (e.g. CVE-2022-22965/Spring4Shell across spring-beans/spring-webmvc, CVE-2020-1938/Ghostcat, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487 in tomcat-embed-core, CVE-2018-1273 in spring-data-commons) or carry near-certain EPSS scores (0.5-1.0) on critical/high severity findings (e.g. CVE-2019-0232, CVE-2019-0199, CVE-2019-10072, CVE-2020-9484, CVE-2024-50379, CVE-2022-34169). These libraries (tomcat-embed-core, spring-webmvc, spring-beans) show substantial class loading (166-387 classes used), meaning the code is actively exercised and 'the vulnerable path hasn't fired yet' is a probabilistic, not structural, claim. Everything justified by code_not_reachable (0 classes loaded) is sound regardless of severity, and duration-only claims on medium/low severity or low-EPSS critical/high CVEs are reasonable as-is. -**Recommendation:** Have a human reviewer manually verify reachability (not just runtime absence) for the KEV-listed items first: CVE-2022-22965 on spring-webmvc and spring-beans, CVE-2018-1273 on spring-data-commons, CVE-2020-1938, CVE-2025-24813, CVE-2017-12617, and CVE-2023-44487 on tomcat-embed-core. After that, prioritize the jackson-databind critical CVEs, since the version is loaded and widely used (263 of 582 classes), before trusting this VEX file for a risk acceptance decision. The code_not_reachable claims (snakeyaml, netty, plexus-utils, jetty-http, bootstrap, commons-compress, commons-io, htmlunit, neko-htmlunit, junit, commons-lang, commons-lang3, httpclient, spring-boot-starter-web, spring-boot-starter-actuator) can be relied on as-is. +**Recommendation:** Have a human reviewer specifically re-examine the 20 flagged CVEs below before treating them as closed, prioritizing the four KEV-listed findings on spring-beans/spring-webmvc (CVE-2022-22965) and tomcat-embed-core (CVE-2020-1938, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487) plus CVE-2018-1273, given their combination of severity, exploitability, and confirmed active code loading. All code_not_reachable claims can be trusted as-is. | CVE | Library | Score | VEX | Rationale | |-----|---------|-------|-----|-----------| -| CVE-2022-22965 | spring-boot-starter-web@1.5.4.RELEASE | 9.8 | NA | Unused | -| CVE-2022-22965 | spring-webmvc@4.3.9.RELEASE | 9.8 | NA | Aged 288d | -| CVE-2022-22965 | spring-beans@4.3.9.RELEASE | 9.8 | NA | Aged 288d | -| CVE-2025-24813 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | -| CVE-2017-12617 | tomcat-embed-core@8.5.15 | 8.1 | NA | Aged 288d | -| CVE-2023-44487 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2020-1938 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | -| CVE-2018-1273 | spring-data-commons@1.13.4.RELEASE | 9.8 | NA | Aged 288d | -| CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Unused | -| CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | Aged 288d | -| CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | Aged 288d | -| CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | Aged 288d | -| CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2025-55752 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2025-31650 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2025-48988 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2020-9484 | tomcat-embed-core@8.5.15 | 7.0 | NA | Aged 288d | -| CVE-2024-38819 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2017-17485 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2019-0221 | tomcat-embed-core@8.5.15 | 6.1 | NA | Aged 288d | -| CVE-2019-12384 | jackson-databind@2.8.8 | 5.9 | NA | Aged 288d | -| CVE-2024-50379 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | -| CVE-2017-7525 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2022-22950 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Aged 288d | -| CVE-2018-1271 | spring-core@4.3.9.RELEASE | 5.9 | NA | Aged 288d | -| CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | Aged 288d | -| CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Unused | -| CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | Aged 288d | -| CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | Aged 288d | -| CVE-2018-8014 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | -| CVE-2019-12086 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | -| CVE-2020-36179 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2018-8034 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2018-1336 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2018-7489 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2021-21295 | netty@3.5.7.Final | 5.9 | NA | Unused | -| CVE-2020-9548 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2020-9547 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2020-25649 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | -| CVE-2021-25122 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2018-1304 | tomcat-embed-core@8.5.15 | 5.9 | NA | Aged 288d | -| CVE-2012-0881 | xercesimpl@2.11.0 | 0.0 | NA | Aged 288d | -| CVE-2019-8331 | bootstrap@3.3.6 | 6.1 | NA | Unused | -| CVE-2018-1305 | tomcat-embed-core@8.5.15 | 6.5 | NA | Aged 288d | -| CVE-2024-21733 | tomcat-embed-core@8.5.15 | 5.3 | NA | Aged 288d | -| CVE-2018-14718 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2019-20445 | netty@3.5.7.Final | 9.1 | NA | Unused | -| CVE-2020-35728 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2021-36090 | commons-compress@1.9 | 7.5 | NA | Unused | -| CVE-2022-25647 | gson@2.8.0 | 7.5 | NA | Aged 288d | -| CVE-2021-35516 | commons-compress@1.9 | 7.5 | NA | Unused | -| CVE-2021-35515 | commons-compress@1.9 | 7.5 | NA | Unused | -| CVE-2022-23437 | xercesimpl@2.11.0 | 6.5 | NA | Aged 288d | -| CVE-2019-14540 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2018-19361 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2018-19360 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2018-19362 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2020-36188 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2019-14439 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | -| CVE-2019-17563 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2021-35517 | commons-compress@1.9 | 7.5 | NA | Unused | -| CVE-2019-12814 | jackson-databind@2.8.8 | 5.9 | NA | Aged 288d | -| CVE-2018-8037 | tomcat-embed-core@8.5.15 | 5.9 | NA | Aged 288d | -| CVE-2018-14721 | jackson-databind@2.8.8 | 10.0 | NA | Aged 288d | -| CVE-2018-14719 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2020-36184 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2021-29425 | commons-io@2.4 | 4.8 | NA | Unused | -| CVE-2019-20330 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2019-20444 | netty@3.5.7.Final | 9.1 | NA | Unused | -| CVE-2020-35491 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2020-24616 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2018-12023 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | -| CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | Aged 288d | -| CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Unused | -| CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2017-5929 | logback-core@1.1.11 | 9.8 | NA | Aged 288d | -| CVE-2017-5929 | logback-classic@1.1.11 | 9.8 | NA | Aged 288d | -| CVE-2020-10673 | jackson-databind@2.8.8 | 8.8 | NA | Aged 288d | -| CVE-2020-35490 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2019-16869 | netty@3.5.7.Final | 7.5 | NA | Unused | -| CVE-2020-10683 | dom4j@1.6.1 | 9.8 | NA | Aged 288d | -| CVE-2021-20190 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2018-5968 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2020-24750 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2018-12022 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | -| CVE-2018-1000632 | dom4j@1.6.1 | 7.5 | NA | Aged 288d | -| CVE-2021-37137 | netty@3.5.7.Final | 7.5 | NA | Unused | -| CVE-2018-11307 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2019-14892 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Unused | -| CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Unused | -| CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2019-17267 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2019-17531 | jackson-databind@2.8.8 | 9.8 | NA | Aged 288d | -| CVE-2020-36182 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2020-36180 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2020-36186 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2020-36181 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2020-36185 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2020-36187 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2020-36189 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2020-36183 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2020-5529 | htmlunit@2.21 | 8.1 | NA | Unused | -| CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | -| CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Unused | -| CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Unused | -| CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | Aged 288d | -| CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Unused | -| CVE-2022-41853 | hsqldb@2.3.5 | 9.8 | NA | Aged 288d | -| CVE-2025-31651 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | -| CVE-2018-3258 | mysql-connector-java@5.1.42 | 8.8 | NA | Aged 288d | -| CVE-2024-22243 | spring-web@4.3.9.RELEASE | 8.1 | NA | Aged 288d | -| CVE-2021-42550 | logback-core@1.1.11 | 6.6 | NA | Aged 288d | -| CVE-2018-14042 | bootstrap@3.3.6 | 6.1 | NA | Unused | -| CVE-2018-14040 | bootstrap@3.3.6 | 6.1 | NA | Unused | -| CVE-2016-10735 | bootstrap@3.3.6 | 6.1 | NA | Unused | -| CVE-2018-20677 | bootstrap@3.3.6 | 6.1 | NA | Unused | -| CVE-2018-20676 | bootstrap@3.3.6 | 6.1 | NA | Unused | -| CVE-2023-26119 | htmlunit@2.21 | 9.8 | NA | Unused | -| CVE-2020-10650 | jackson-databind@2.8.8 | 8.1 | NA | Aged 288d | -| CVE-2024-22259 | spring-web@4.3.9.RELEASE | 8.1 | NA | Aged 288d | -| CVE-2022-42004 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | -| CVE-2022-42003 | jackson-databind@2.8.8 | 7.5 | NA | Aged 288d | -| CVE-2022-25857 | snakeyaml@1.17 | 7.5 | NA | Unused | -| CVE-2023-46589 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2025-49125 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2018-1272 | spring-core@4.3.9.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2018-11040 | spring-core@4.3.9.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2020-25638 | hibernate-core@5.0.4.Final | 7.4 | NA | Aged 288d | -| CVE-2025-46701 | tomcat-embed-core@8.5.15 | 7.3 | NA | Aged 288d | -| CVE-2022-38752 | snakeyaml@1.17 | 6.5 | NA | Unused | -| CVE-2021-43797 | netty@3.5.7.Final | 6.5 | NA | Unused | -| CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | Aged 288d | -| CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | Aged 288d | -| CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2025-53506 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2025-52520 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2022-28366 | neko-htmlunit@2.21 | 7.5 | NA | Unused | -| CVE-2022-38749 | snakeyaml@1.17 | 6.5 | NA | Unused | -| CVE-2022-38751 | snakeyaml@1.17 | 6.5 | NA | Unused | -| CVE-2019-14900 | hibernate-core@5.0.4.Final | 6.5 | NA | Aged 288d | -| CVE-2024-23672 | tomcat-embed-websocket@8.5.15 | 6.3 | NA | Aged 288d | -| CVE-2021-21290 | netty@3.5.7.Final | 5.5 | NA | Unused | -| CVE-2020-15250 | junit@4.12 | 5.5 | NA | Unused | -| CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Aged 288d | -| CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Unused | -| CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Unused | -| CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | Aged 288d | -| CVE-2026-43515 | tomcat-embed-core@8.5.15 | 9.1 | NA | Aged 288d | -| CVE-2026-2332 | jetty-http@9.4.5.v20170502 | 9.1 | NA | Unused | -| CVE-2026-40477 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Aged 288d | -| CVE-2026-40478 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Aged 288d | -| CVE-2025-67030 | plexus-utils@3.0.8 | 8.8 | NA | Unused | -| CVE-2023-22102 | mysql-connector-java@5.1.42 | 8.3 | NA | Aged 288d | -| CVE-2024-22262 | spring-web@4.3.9.RELEASE | 8.1 | NA | Aged 288d | -| CVE-2022-27772 | spring-boot@1.5.4.RELEASE | 7.8 | NA | Aged 288d | -| CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | Aged 288d | -| CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | Aged 288d | -| CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Unused | -| CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Unused | -| CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | Aged 288d | -| CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Unused | -| CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Aged 288d | -| CVE-2023-20861 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Aged 288d | -| CVE-2023-34055 | spring-boot-actuator@1.5.4.RELEASE | 6.5 | NA | Aged 288d | -| CVE-2019-2692 | mysql-connector-java@5.1.42 | 6.3 | NA | Aged 288d | -| CVE-2018-1196 | spring-boot@1.5.4.RELEASE | 5.9 | NA | Aged 288d | -| CVE-2022-38750 | snakeyaml@1.17 | 5.5 | NA | Unused | -| CVE-2024-38820 | spring-web@4.3.9.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2024-38809 | spring-web@4.3.9.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2025-61795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Aged 288d | -| CVE-2024-6763 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Unused | -| CVE-2023-40167 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Unused | -| CVE-2020-14338 | xercesimpl@2.11.0 | 5.3 | NA | Aged 288d | -| CVE-2019-3797 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2019-3802 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2024-38820 | spring-context@4.3.9.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2022-4245 | plexus-utils@3.0.8 | 4.3 | NA | Unused | -| CVE-2021-22096 | spring-core@4.3.9.RELEASE | 4.3 | NA | Aged 288d | -| CVE-2024-38808 | spring-expression@4.3.9.RELEASE | 4.3 | NA | Aged 288d | -| CVE-2024-47554 | commons-io@2.4 | 4.3 | NA | Unused | -| CVE-2020-8908 | guava@19.0 | 3.3 | NA | Aged 288d | -| CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Unused | -| CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | Aged 288d | -| CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | Aged 288d | -| CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Aged 288d | -| CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Unused | -| CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2026-41842 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2026-43513 | tomcat-embed-core@8.5.15 | 7.5 | NA | Aged 288d | -| CVE-2026-41848 | spring-core@4.3.9.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2026-41850 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2026-41851 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2026-41849 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Aged 288d | -| CVE-2025-22235 | spring-boot@1.5.4.RELEASE | 7.3 | NA | Aged 288d | -| CVE-2023-2976 | guava@19.0 | 7.1 | NA | Aged 288d | -| CVE-2026-40973 | spring-boot@1.5.4.RELEASE | 7.0 | NA | Aged 288d | -| CVE-2017-7536 | hibernate-validator@5.3.5.Final | 7.0 | NA | Aged 288d | -| CVE-2025-11143 | jetty-http@9.4.5.v20170502 | 6.5 | NA | Unused | -| CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Aged 288d | -| CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Aged 288d | -| CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Aged 288d | -| CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Aged 288d | -| CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Aged 288d | -| CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Aged 288d | -| CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Aged 288d | -| CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Unused | -| CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | Aged 288d | -| CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | Aged 288d | -| CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | Aged 288d | -| CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | Aged 288d | -| CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | -| CVE-2026-1225 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | -| CVE-2026-9828 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | -| CVE-2025-11226 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | -| CVE-2024-12798 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | -| CVE-2024-12801 | logback-core@1.1.11 | 0.0 | NA | Aged 288d | +| CVE-2022-22965 | spring-boot-starter-web@1.5.4.RELEASE | 9.8 | NA | Library Unused | +| CVE-2022-22965 | spring-webmvc@4.3.9.RELEASE | 9.8 | NA | CVE Not Used 288d | +| CVE-2022-22965 | spring-beans@4.3.9.RELEASE | 9.8 | NA | CVE Not Used 288d | +| CVE-2025-24813 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | +| CVE-2017-12617 | tomcat-embed-core@8.5.15 | 8.1 | NA | CVE Not Used 288d | +| CVE-2023-44487 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2020-1938 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | +| CVE-2018-1273 | spring-data-commons@1.13.4.RELEASE | 9.8 | NA | CVE Not Used 288d | +| CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Library Unused | +| CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | CVE Not Used 288d | +| CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | CVE Not Used 288d | +| CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | CVE Not Used 288d | +| CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2025-55752 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2025-31650 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2025-48988 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2020-9484 | tomcat-embed-core@8.5.15 | 7.0 | NA | CVE Not Used 288d | +| CVE-2024-38819 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2017-17485 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2019-0221 | tomcat-embed-core@8.5.15 | 6.1 | NA | CVE Not Used 288d | +| CVE-2019-12384 | jackson-databind@2.8.8 | 5.9 | NA | CVE Not Used 288d | +| CVE-2024-50379 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | +| CVE-2017-7525 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2022-22950 | spring-expression@4.3.9.RELEASE | 6.5 | NA | CVE Not Used 288d | +| CVE-2018-1271 | spring-core@4.3.9.RELEASE | 5.9 | NA | CVE Not Used 288d | +| CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | CVE Not Used 288d | +| CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Library Unused | +| CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | CVE Not Used 288d | +| CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | CVE Not Used 288d | +| CVE-2018-8014 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | +| CVE-2019-12086 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | +| CVE-2020-36179 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2018-8034 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2018-1336 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2018-7489 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2021-21295 | netty@3.5.7.Final | 5.9 | NA | Library Unused | +| CVE-2020-9548 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2020-9547 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2020-25649 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | +| CVE-2021-25122 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2018-1304 | tomcat-embed-core@8.5.15 | 5.9 | NA | CVE Not Used 288d | +| CVE-2012-0881 | xercesimpl@2.11.0 | 0.0 | NA | CVE Not Used 288d | +| CVE-2019-8331 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | +| CVE-2018-1305 | tomcat-embed-core@8.5.15 | 6.5 | NA | CVE Not Used 288d | +| CVE-2024-21733 | tomcat-embed-core@8.5.15 | 5.3 | NA | CVE Not Used 288d | +| CVE-2018-14718 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2019-20445 | netty@3.5.7.Final | 9.1 | NA | Library Unused | +| CVE-2020-35728 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2021-36090 | commons-compress@1.9 | 7.5 | NA | Library Unused | +| CVE-2022-25647 | gson@2.8.0 | 7.5 | NA | CVE Not Used 288d | +| CVE-2021-35516 | commons-compress@1.9 | 7.5 | NA | Library Unused | +| CVE-2021-35515 | commons-compress@1.9 | 7.5 | NA | Library Unused | +| CVE-2022-23437 | xercesimpl@2.11.0 | 6.5 | NA | CVE Not Used 288d | +| CVE-2019-14540 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2018-19361 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2018-19360 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2018-19362 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2020-36188 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2019-14439 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | +| CVE-2019-17563 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2021-35517 | commons-compress@1.9 | 7.5 | NA | Library Unused | +| CVE-2019-12814 | jackson-databind@2.8.8 | 5.9 | NA | CVE Not Used 288d | +| CVE-2018-8037 | tomcat-embed-core@8.5.15 | 5.9 | NA | CVE Not Used 288d | +| CVE-2018-14721 | jackson-databind@2.8.8 | 10.0 | NA | CVE Not Used 288d | +| CVE-2018-14719 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2020-36184 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2021-29425 | commons-io@2.4 | 4.8 | NA | Library Unused | +| CVE-2019-20330 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2019-20444 | netty@3.5.7.Final | 9.1 | NA | Library Unused | +| CVE-2020-35491 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2020-24616 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2018-12023 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | +| CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | CVE Not Used 288d | +| CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Library Unused | +| CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2017-5929 | logback-core@1.1.11 | 9.8 | NA | CVE Not Used 288d | +| CVE-2017-5929 | logback-classic@1.1.11 | 9.8 | NA | CVE Not Used 288d | +| CVE-2020-10673 | jackson-databind@2.8.8 | 8.8 | NA | CVE Not Used 288d | +| CVE-2020-35490 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2019-16869 | netty@3.5.7.Final | 7.5 | NA | Library Unused | +| CVE-2020-10683 | dom4j@1.6.1 | 9.8 | NA | CVE Not Used 288d | +| CVE-2021-20190 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2018-5968 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2020-24750 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2018-12022 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | +| CVE-2018-1000632 | dom4j@1.6.1 | 7.5 | NA | CVE Not Used 288d | +| CVE-2021-37137 | netty@3.5.7.Final | 7.5 | NA | Library Unused | +| CVE-2018-11307 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2019-14892 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Library Unused | +| CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Library Unused | +| CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2019-17267 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2019-17531 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | +| CVE-2020-36182 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2020-36180 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2020-36186 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2020-36181 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2020-36185 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2020-36187 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2020-36189 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2020-36183 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2020-5529 | htmlunit@2.21 | 8.1 | NA | Library Unused | +| CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | +| CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Library Unused | +| CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Library Unused | +| CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | CVE Not Used 288d | +| CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Library Unused | +| CVE-2022-41853 | hsqldb@2.3.5 | 9.8 | NA | CVE Not Used 288d | +| CVE-2025-31651 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | +| CVE-2018-3258 | mysql-connector-java@5.1.42 | 8.8 | NA | CVE Not Used 288d | +| CVE-2024-22243 | spring-web@4.3.9.RELEASE | 8.1 | NA | CVE Not Used 288d | +| CVE-2021-42550 | logback-core@1.1.11 | 6.6 | NA | CVE Not Used 288d | +| CVE-2018-14042 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | +| CVE-2018-14040 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | +| CVE-2016-10735 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | +| CVE-2018-20677 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | +| CVE-2018-20676 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | +| CVE-2023-26119 | htmlunit@2.21 | 9.8 | NA | Library Unused | +| CVE-2020-10650 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | +| CVE-2024-22259 | spring-web@4.3.9.RELEASE | 8.1 | NA | CVE Not Used 288d | +| CVE-2022-42004 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | +| CVE-2022-42003 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | +| CVE-2022-25857 | snakeyaml@1.17 | 7.5 | NA | Library Unused | +| CVE-2023-46589 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2025-49125 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2018-1272 | spring-core@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2018-11040 | spring-core@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2020-25638 | hibernate-core@5.0.4.Final | 7.4 | NA | CVE Not Used 288d | +| CVE-2025-46701 | tomcat-embed-core@8.5.15 | 7.3 | NA | CVE Not Used 288d | +| CVE-2022-38752 | snakeyaml@1.17 | 6.5 | NA | Library Unused | +| CVE-2021-43797 | netty@3.5.7.Final | 6.5 | NA | Library Unused | +| CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | CVE Not Used 288d | +| CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | CVE Not Used 288d | +| CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2025-53506 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2025-52520 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2022-28366 | neko-htmlunit@2.21 | 7.5 | NA | Library Unused | +| CVE-2022-38749 | snakeyaml@1.17 | 6.5 | NA | Library Unused | +| CVE-2022-38751 | snakeyaml@1.17 | 6.5 | NA | Library Unused | +| CVE-2019-14900 | hibernate-core@5.0.4.Final | 6.5 | NA | CVE Not Used 288d | +| CVE-2024-23672 | tomcat-embed-websocket@8.5.15 | 6.3 | NA | CVE Not Used 288d | +| CVE-2021-21290 | netty@3.5.7.Final | 5.5 | NA | Library Unused | +| CVE-2020-15250 | junit@4.12 | 5.5 | NA | Library Unused | +| CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | CVE Not Used 288d | +| CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Library Unused | +| CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Library Unused | +| CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | +| CVE-2026-43515 | tomcat-embed-core@8.5.15 | 9.1 | NA | CVE Not Used 288d | +| CVE-2026-2332 | jetty-http@9.4.5.v20170502 | 9.1 | NA | Library Unused | +| CVE-2026-40477 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | CVE Not Used 288d | +| CVE-2026-40478 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | CVE Not Used 288d | +| CVE-2025-67030 | plexus-utils@3.0.8 | 8.8 | NA | Library Unused | +| CVE-2023-22102 | mysql-connector-java@5.1.42 | 8.3 | NA | CVE Not Used 288d | +| CVE-2024-22262 | spring-web@4.3.9.RELEASE | 8.1 | NA | CVE Not Used 288d | +| CVE-2022-27772 | spring-boot@1.5.4.RELEASE | 7.8 | NA | CVE Not Used 288d | +| CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | CVE Not Used 288d | +| CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | CVE Not Used 288d | +| CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Library Unused | +| CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Library Unused | +| CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | CVE Not Used 288d | +| CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Library Unused | +| CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | CVE Not Used 288d | +| CVE-2023-20861 | spring-expression@4.3.9.RELEASE | 6.5 | NA | CVE Not Used 288d | +| CVE-2023-34055 | spring-boot-actuator@1.5.4.RELEASE | 6.5 | NA | CVE Not Used 288d | +| CVE-2019-2692 | mysql-connector-java@5.1.42 | 6.3 | NA | CVE Not Used 288d | +| CVE-2018-1196 | spring-boot@1.5.4.RELEASE | 5.9 | NA | CVE Not Used 288d | +| CVE-2022-38750 | snakeyaml@1.17 | 5.5 | NA | Library Unused | +| CVE-2024-38820 | spring-web@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2024-38809 | spring-web@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2025-61795 | tomcat-embed-core@8.5.15 | 5.3 | NA | CVE Not Used 288d | +| CVE-2024-6763 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Library Unused | +| CVE-2023-40167 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Library Unused | +| CVE-2020-14338 | xercesimpl@2.11.0 | 5.3 | NA | CVE Not Used 288d | +| CVE-2019-3797 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2019-3802 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2024-38820 | spring-context@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2022-4245 | plexus-utils@3.0.8 | 4.3 | NA | Library Unused | +| CVE-2021-22096 | spring-core@4.3.9.RELEASE | 4.3 | NA | CVE Not Used 288d | +| CVE-2024-38808 | spring-expression@4.3.9.RELEASE | 4.3 | NA | CVE Not Used 288d | +| CVE-2024-47554 | commons-io@2.4 | 4.3 | NA | Library Unused | +| CVE-2020-8908 | guava@19.0 | 3.3 | NA | CVE Not Used 288d | +| CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Library Unused | +| CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | CVE Not Used 288d | +| CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | CVE Not Used 288d | +| CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | CVE Not Used 288d | +| CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Library Unused | +| CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2026-41842 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2026-43513 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | +| CVE-2026-41848 | spring-core@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2026-41850 | spring-expression@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2026-41851 | spring-expression@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2026-41849 | spring-expression@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | +| CVE-2025-22235 | spring-boot@1.5.4.RELEASE | 7.3 | NA | CVE Not Used 288d | +| CVE-2023-2976 | guava@19.0 | 7.1 | NA | CVE Not Used 288d | +| CVE-2026-40973 | spring-boot@1.5.4.RELEASE | 7.0 | NA | CVE Not Used 288d | +| CVE-2017-7536 | hibernate-validator@5.3.5.Final | 7.0 | NA | CVE Not Used 288d | +| CVE-2025-11143 | jetty-http@9.4.5.v20170502 | 6.5 | NA | Library Unused | +| CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | CVE Not Used 288d | +| CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | CVE Not Used 288d | +| CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | CVE Not Used 288d | +| CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | CVE Not Used 288d | +| CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | CVE Not Used 288d | +| CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | CVE Not Used 288d | +| CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | CVE Not Used 288d | +| CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Library Unused | +| CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | +| CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | CVE Not Used 288d | +| CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | CVE Not Used 288d | +| CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | CVE Not Used 288d | +| CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | +| CVE-2026-1225 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | +| CVE-2026-9828 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | +| CVE-2025-11226 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | +| CVE-2024-12798 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | +| CVE-2024-12801 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | --- diff --git a/samples/sample-vex.json b/samples/sample-vex.json index 818cbf7..bd1e181 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -3,7 +3,7 @@ "specVersion": "1.6", "version": 1, "metadata": { - "timestamp": "2026-09-03T01:28:45Z", + "timestamp": "2026-09-03T01:52:49Z", "component": { "type": "application", "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", @@ -113,11 +113,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity jackson-databind gadget-chain CVE excused only by 288 days without observed execution in a library that is heavily loaded (263 of 582 classes), not by non-reachability." + "value": "Critical severity but EPSS is low (0.1) and 288 days comfortably exceeds threshold; reasonable duration-based acceptance." } ] }, @@ -223,11 +223,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only reasoning on a critical CVE in a loaded jackson-databind, worth a manual reachability check before relying on it." + "value": "Critical severity but EPSS is very low (0.06); duration-based acceptance is reasonable." } ] }, @@ -337,7 +337,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE with a notably elevated EPSS score (0.5) accepted purely on absence of observed execution, a weaker signal given the exploitability." + "value": "Critical severity with elevated EPSS (0.5, 98.8th percentile) relying solely on absence-of-execution; library is actively loaded (263/582 classes), so this warrants human confirmation." } ] }, @@ -443,11 +443,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical jackson-databind CVE with EPSS 0.27 relying only on duration, warrants review given how heavily the library is used." + "value": "Critical severity, EPSS 0.27 is moderate; duration-based acceptance is within reasonable bounds." } ] }, @@ -553,11 +553,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification on a heavily loaded gadget-chain-prone library." + "value": "Critical severity but EPSS very low (0.05); duration-based acceptance reasonable." } ] }, @@ -663,11 +663,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim resting solely on absence of execution rather than reachability analysis." + "value": "Critical severity, low EPSS (0.09); acceptable duration-based claim." } ] }, @@ -773,11 +773,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE justified only by runtime silence in a library with heavy class usage." + "value": "Critical severity, low EPSS (0.13); acceptable duration-based claim." } ] }, @@ -883,11 +883,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Duration-only not_affected claim on a critical jackson-databind deserialization CVE." + "value": "Critical severity, low EPSS (0.08); acceptable duration-based claim." } ] }, @@ -993,11 +993,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, no structural reachability guarantee, same jackson-databind gadget-chain family." + "value": "Critical severity, low EPSS (0.1); acceptable duration-based claim." } ] }, @@ -1103,11 +1103,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE with EPSS 0.18 accepted only on the basis of no observed execution." + "value": "Critical severity, moderate EPSS (0.18); acceptable duration-based claim." } ] }, @@ -1213,11 +1213,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical jackson-databind CVE, duration-only acceptance, worth confirming reachability." + "value": "Critical severity, low EPSS (0.11); acceptable duration-based claim." } ] }, @@ -1323,11 +1323,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE with EPSS 0.18, absence-only reasoning, same underlying heavily-used library." + "value": "Critical severity, moderate EPSS (0.18); acceptable duration-based claim." } ] }, @@ -1433,11 +1433,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim relying only on runtime observation, not code-level non-reachability." + "value": "Critical severity, low EPSS (0.06); acceptable duration-based claim." } ] }, @@ -1543,11 +1543,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only acceptance in a heavily loaded library." + "value": "Critical severity, low EPSS (0.06); acceptable duration-based claim." } ] }, @@ -1653,11 +1653,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical jackson-databind CVE excused only by absence of observed execution." + "value": "Critical severity, low EPSS (0.11); acceptable duration-based claim." } ] }, @@ -1763,11 +1763,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, no structural reachability finding, duration-only claim." + "value": "Critical severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -1873,11 +1873,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim resting solely on 288 days of runtime silence." + "value": "Critical severity, low EPSS (0.11); acceptable duration-based claim." } ] }, @@ -1983,11 +1983,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE, duration-only not_affected claim in a widely used library." + "value": "Critical severity, low EPSS (0.11); acceptable duration-based claim." } ] }, @@ -2093,11 +2093,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, absence-of-execution justification only, worth confirming." + "value": "Critical severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -2207,7 +2207,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE with an elevated EPSS score (0.38), duration-only acceptance is weaker evidence here." + "value": "Critical severity with elevated EPSS (0.38, 98.4th percentile) resting solely on absence-of-execution over an actively loaded library; worth confirming." } ] }, @@ -2313,11 +2313,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification, worth manual confirmation." + "value": "Critical severity, moderate EPSS (0.2); acceptable duration-based claim." } ] }, @@ -2423,11 +2423,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE, no structural non-reachability guarantee, only runtime silence." + "value": "Critical severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -2533,11 +2533,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity gadget-chain CVE accepted purely on absence of observed execution." + "value": "Critical severity, low EPSS (0.08); acceptable duration-based claim." } ] }, @@ -2643,11 +2643,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning in a heavily used library." + "value": "Critical severity, low EPSS (0.08); acceptable duration-based claim." } ] }, @@ -2753,11 +2753,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE excused only by 288 days without observed execution rather than reachability analysis." + "value": "High severity, low EPSS (0.08); acceptable duration-based claim." } ] }, @@ -2863,11 +2863,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted on duration alone in a heavily loaded library." + "value": "High severity, low EPSS (0.13); acceptable duration-based claim." } ] }, @@ -2973,11 +2973,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, same duration-only acceptance pattern across the jackson-databind gadget family." + "value": "High severity, low EPSS (0.09); acceptable duration-based claim." } ] }, @@ -3083,11 +3083,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, absence-of-execution justification only." + "value": "High severity, low EPSS (0.08); acceptable duration-based claim." } ] }, @@ -3193,11 +3193,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only claim, worth confirming reachability." + "value": "High severity, low EPSS (0.1); acceptable duration-based claim." } ] }, @@ -3303,11 +3303,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE resting only on runtime silence." + "value": "High severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -3413,11 +3413,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, absence-of-execution justification, no code-level guarantee." + "value": "High severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -3523,11 +3523,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, duration-only acceptance in a heavily used library." + "value": "High severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -3633,11 +3633,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, same duration-only pattern, worth review." + "value": "High severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -3743,11 +3743,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.21, duration-only acceptance is a weaker signal." + "value": "High severity, moderate EPSS (0.21); acceptable duration-based claim." } ] }, @@ -3853,11 +3853,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification in a heavily loaded library." + "value": "High severity, very low EPSS (0.03); acceptable duration-based claim." } ] }, @@ -3963,11 +3963,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, absence-of-execution reasoning only." + "value": "High severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -4073,11 +4073,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only claim, worth confirming." + "value": "High severity, low EPSS (0.11); acceptable duration-based claim." } ] }, @@ -4183,11 +4183,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE excused only by runtime silence." + "value": "High severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -4293,11 +4293,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, same gadget-chain family, duration-only acceptance." + "value": "High severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -4403,11 +4403,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, no structural non-reachability guarantee." + "value": "High severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -4513,11 +4513,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification, worth review." + "value": "High severity, low EPSS (0.07); acceptable duration-based claim." } ] }, @@ -4623,11 +4623,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE accepted purely on absence of observed execution." + "value": "High severity, low EPSS (0.07); acceptable duration-based claim." } ] }, @@ -4733,11 +4733,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only claim in a heavily loaded library." + "value": "High severity, low EPSS (0.09); acceptable duration-based claim." } ] }, @@ -4843,11 +4843,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, no code-level reachability finding." + "value": "High severity, low EPSS (0.07); acceptable duration-based claim." } ] }, @@ -4953,11 +4953,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE (7.5), duration-only acceptance is a weaker basis for reliance." + "value": "High severity, very low EPSS (0.03); acceptable duration-based claim." } ] }, @@ -5063,11 +5063,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, same duration-only reasoning as the paired CVE-2022-42004." + "value": "High severity, very low EPSS (0.03); acceptable duration-based claim." } ] }, @@ -5173,11 +5173,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.18, duration-only acceptance is weaker evidence." + "value": "High severity, moderate EPSS (0.18); acceptable duration-based claim." } ] }, @@ -5283,11 +5283,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only claim, worth manual confirmation." + "value": "High severity, low EPSS (0.09); acceptable duration-based claim." } ] }, @@ -5393,11 +5393,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE excused only by absence of observed execution." + "value": "High severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -5503,11 +5503,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only reasoning in a heavily used library." + "value": "High severity, low EPSS (0.11); acceptable duration-based claim." } ] }, @@ -5613,11 +5613,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, no structural non-reachability guarantee." + "value": "High severity, low EPSS (0.07); acceptable duration-based claim." } ] }, @@ -5723,11 +5723,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.22, duration-only acceptance warrants review." + "value": "High severity, moderate EPSS (0.22); acceptable duration-based claim." } ] }, @@ -5837,7 +5837,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes if the absence-of-execution reasoning is ever wrong, even though EPSS is elevated at 0.45." + "value": "Medium severity; lower stakes make duration-based acceptance reasonable even with elevated EPSS." } ] }, @@ -5947,7 +5947,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity CVE accepted on duration, acceptable risk given the lower severity." + "value": "Medium severity; duration-based acceptance is fine at this risk tier." } ] }, @@ -6055,7 +6055,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable with zero of 1295 classes loaded, a structural fact independent of severity." + "value": "code_not_reachable with 0 of 1295 classes loaded; a structural fact, safe regardless of critical severity." } ] }, @@ -6163,7 +6163,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, safe to rely on regardless of high severity." + "value": "code_not_reachable, 0 classes loaded; structurally sound." } ] }, @@ -6269,11 +6269,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE in dom4j accepted only on runtime silence, and the library does have one class loaded, so it is not a clean structural exclusion." + "value": "Critical severity but EPSS low (0.07) and only 1 of 190 classes ever loaded, suggesting minimal library surface exercised; acceptable." } ] }, @@ -6379,11 +6379,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity dom4j CVE with duration-only justification, worth confirming." + "value": "High severity, low EPSS (0.07); acceptable duration-based claim." } ] }, @@ -6491,7 +6491,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero of 206 classes loaded, structurally sound despite critical severity and very high EPSS (1.0)." + "value": "code_not_reachable, 0 of 206 classes loaded; structurally sound despite critical severity and very high EPSS (1.0)." } ] }, @@ -6599,7 +6599,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable justification, zero classes loaded, reliable regardless of severity." + "value": "code_not_reachable; structural non-reachability, safe as-is." } ] }, @@ -6707,7 +6707,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, no snakeyaml classes ever loaded, a structural fact." + "value": "code_not_reachable; structural non-reachability, safe as-is." } ] }, @@ -6815,7 +6815,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, library never loaded, safe to trust." + "value": "code_not_reachable; structural non-reachability, safe as-is." } ] }, @@ -6923,7 +6923,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, low risk to rely on." + "value": "code_not_reachable; structural non-reachability, safe as-is." } ] }, @@ -7031,7 +7031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structurally excluded library." + "value": "code_not_reachable; structural non-reachability, safe as-is." } ] }, @@ -7139,7 +7139,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable justification is structural, not probabilistic." + "value": "code_not_reachable; structural non-reachability, safe as-is." } ] }, @@ -7247,7 +7247,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, safe to rely on." + "value": "code_not_reachable; structural non-reachability, safe as-is." } ] }, @@ -7355,7 +7355,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Spring4Shell against spring-beans, KEV-listed and critical, with 202 of 408 classes actively loaded, excused only by runtime silence. Needs manual verification." + "value": "Critical severity, CISA KEV listed, EPSS 1.0, with 202 of 408 classes of spring-beans actively loaded; duration-only claim on a KEV entry with this much surface exercised should be verified." } ] }, @@ -7465,7 +7465,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed remote code execution CVE in spring-data-commons excused only by absence of observed execution in a heavily loaded library (152 of 554 classes). This is exactly the kind of claim that needs a human reachability check before relying on it." + "value": "Critical severity, CISA KEV listed, EPSS near-certain (0.97), with 152 of 554 classes actively loaded; a pure absence-of-execution claim is a weak basis to dismiss this and should be confirmed by a human." } ] }, @@ -7571,11 +7571,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-data-commons CVE, duration-only acceptance, same library as the KEV entry above." + "value": "High severity but very low EPSS (0.02); acceptable duration-based claim." } ] }, @@ -7681,11 +7681,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification, though EPSS is very low (near zero), worth a lighter-touch confirmation." + "value": "High severity but essentially zero EPSS (0.0); acceptable duration-based claim." } ] }, @@ -7795,7 +7795,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, acceptable to rely on duration-based reasoning." + "value": "Medium severity, negligible EPSS; acceptable." } ] }, @@ -7905,7 +7905,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity CVE with very low EPSS, lower stakes." + "value": "Medium severity, negligible EPSS; acceptable." } ] }, @@ -8013,7 +8013,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity is unscored/unknown, lower stakes for a duration-only claim." + "value": "Unknown/no severity score; low stakes duration-based claim is acceptable." } ] }, @@ -8119,11 +8119,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity hsqldb CVE excused only by absence of observed execution in a heavily loaded library (229 of 601 classes)." + "value": "Critical severity but low EPSS (0.04); acceptable duration-based claim." } ] }, @@ -8229,11 +8229,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity logback-classic CVE, duration-only claim in a loaded library (63 of 178 classes)." + "value": "Critical severity (logback-classic), low EPSS (0.08); acceptable duration-based claim." } ] }, @@ -8339,11 +8339,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity logback-classic CVE, absence-of-execution reasoning only." + "value": "High severity (logback-classic), very low EPSS (0.01); acceptable." } ] }, @@ -8453,7 +8453,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable to rely on duration alone." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -8561,7 +8561,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, low stakes for a duration-based claim." + "value": "Unknown severity, negligible EPSS; low stakes." } ] }, @@ -8669,7 +8669,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, negligible EPSS, low stakes." + "value": "Unknown severity, negligible EPSS; low stakes." } ] }, @@ -8777,7 +8777,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, low EPSS, acceptable as-is." + "value": "Unknown severity, negligible EPSS; low stakes." } ] }, @@ -8885,7 +8885,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, negligible EPSS, low stakes." + "value": "Unknown severity, negligible EPSS; low stakes." } ] }, @@ -8993,7 +8993,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, low stakes duration-based claim." + "value": "Unknown severity, negligible EPSS; low stakes." } ] }, @@ -9101,7 +9101,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, negligible EPSS, acceptable as-is." + "value": "Unknown severity, negligible EPSS; low stakes." } ] }, @@ -9211,7 +9211,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity spring-web CVE with EPSS 0.32, duration-only acceptance in a heavily loaded library (211 of 559 classes)." + "value": "Critical severity with elevated EPSS (0.32) on an actively-loaded library (211/559 classes); duration-only reasoning is weaker here and merits confirmation." } ] }, @@ -9317,11 +9317,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-web CVE, absence-of-execution reasoning only." + "value": "High severity, low EPSS (0.04); acceptable duration-based claim." } ] }, @@ -9427,11 +9427,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only claim in a widely loaded library." + "value": "High severity, very low EPSS (0.01); acceptable." } ] }, @@ -9537,11 +9537,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE excused only by runtime silence." + "value": "High severity, low EPSS (0.03); acceptable." } ] }, @@ -9651,7 +9651,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable to rely on duration-based reasoning." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -9761,7 +9761,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity spring-context CVE, low stakes duration-based claim (separate library from the spring-web entry with the same CVE ID)." + "value": "Medium severity (spring-context); acceptable duration-based claim." } ] }, @@ -9871,7 +9871,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable to trust the duration claim." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -9981,7 +9981,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Spring4Shell against spring-beans, KEV-listed and critical, with 202 of 408 classes actively loaded, excused only by runtime silence. Needs manual verification." + "value": "Critical severity, CISA KEV listed, EPSS 1.0, with 202 of 408 classes of spring-beans actively loaded; duration-only claim on a KEV entry with this much surface exercised should be verified." } ] }, @@ -10087,11 +10087,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-webmvc CVE, duration-only justification." + "value": "High severity but zero EPSS; acceptable duration-based claim." } ] }, @@ -10201,7 +10201,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with an elevated EPSS score (0.55), duration-only acceptance is a weaker basis for reliance here." + "value": "High severity with notably elevated EPSS (0.55, 98.9th percentile) on an actively loaded library; duration-only reasoning should be double-checked." } ] }, @@ -10311,7 +10311,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, acceptable duration-based claim." + "value": "Medium severity, negligible EPSS; acceptable." } ] }, @@ -10421,7 +10421,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS, low stakes." + "value": "Medium severity, negligible EPSS; acceptable." } ] }, @@ -10531,7 +10531,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity CVE, acceptable to rely on as-is." + "value": "Medium severity, negligible EPSS; acceptable." } ] }, @@ -10641,7 +10641,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, acceptable duration-based reasoning." + "value": "Medium severity, negligible EPSS; acceptable." } ] }, @@ -10751,7 +10751,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity CVE, low stakes." + "value": "Medium severity, negligible EPSS; acceptable." } ] }, @@ -10861,7 +10861,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS, acceptable as-is." + "value": "Medium severity, negligible EPSS; acceptable." } ] }, @@ -10971,7 +10971,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, acceptable to rely on." + "value": "Medium severity, negligible EPSS; acceptable." } ] }, @@ -11081,7 +11081,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, lowest stakes of the spring-webmvc claims." + "value": "Low severity; duration-based claim is fine." } ] }, @@ -11187,11 +11187,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity logback-classic CVE, duration-only claim in a loaded library (63 of 178 classes)." + "value": "Critical severity (logback-classic), low EPSS (0.08); acceptable duration-based claim." } ] }, @@ -11297,11 +11297,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity logback-classic CVE, absence-of-execution reasoning only." + "value": "High severity (logback-classic), very low EPSS (0.01); acceptable." } ] }, @@ -11411,7 +11411,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Spring4Shell against spring-beans, KEV-listed and critical, with 202 of 408 classes actively loaded, excused only by runtime silence. Needs manual verification." + "value": "Critical severity, CISA KEV listed, EPSS 1.0, with 202 of 408 classes of spring-beans actively loaded; duration-only claim on a KEV entry with this much surface exercised should be verified." } ] }, @@ -11521,7 +11521,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity spring-beans CVE, acceptable duration-based claim." + "value": "Medium severity, low EPSS (0.02); acceptable duration-based claim." } ] }, @@ -11627,11 +11627,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity tomcat-embed-core CVE, duration-only acceptance in a widely used library (387 of 1481 classes)." + "value": "Critical severity, moderate EPSS (0.22); acceptable duration-based claim." } ] }, @@ -11741,7 +11741,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical, KEV-listed RCE with a maximum EPSS score, excused only by absence of observed execution rather than reachability. This should be verified manually." + "value": "Critical severity, CISA KEV listed, EPSS 1.0, with substantial library usage (387/1481 classes); a duration-only claim on a KEV, near-certain-EPSS CVE against actively used code should be confirmed by a human." } ] }, @@ -11847,11 +11847,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE, duration-only justification in a heavily loaded Tomcat library." + "value": "Critical severity but very low EPSS (0.01); acceptable duration-based claim." } ] }, @@ -11961,7 +11961,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "The Ghostcat CVE, KEV-listed and critical with EPSS 0.99, is accepted only on runtime silence, not code-level non-reachability. Warrants manual review." + "value": "Critical severity, CISA KEV listed (Ghostcat), EPSS near-certain (0.99); duration-only reasoning against an actively loaded library warrants review." } ] }, @@ -12067,11 +12067,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE, duration-only claim in a widely-used library." + "value": "Critical severity but low EPSS (0.04); acceptable duration-based claim." } ] }, @@ -12181,7 +12181,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE with an elevated EPSS score (0.44), duration-only acceptance is weaker evidence here." + "value": "Critical severity with elevated EPSS (0.44, 98.7th percentile) on an actively loaded library; should be confirmed rather than relying on absence of observed execution alone." } ] }, @@ -12287,11 +12287,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE, duration-only justification, worth confirming." + "value": "Critical severity but very low EPSS (0.01); acceptable duration-based claim." } ] }, @@ -12401,7 +12401,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with a maximum EPSS score of 1.0, excused only by absence of observed execution." + "value": "High severity with EPSS at 1.0 (99.95th percentile); despite no KEV listing, this near-certain exploitation probability against actively loaded code warrants human confirmation." } ] }, @@ -12511,7 +12511,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed high severity RCE with EPSS 1.0, accepted only on runtime silence. Should be manually verified." + "value": "High severity, CISA KEV listed, EPSS 1.0; duration-only reasoning is a weak basis given both KEV status and near-certain exploitation probability." } ] }, @@ -12621,7 +12621,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.73, duration-only acceptance is weaker evidence for a CVE this exploitable." + "value": "High severity with elevated EPSS (0.73, 99.4th percentile); worth confirming given the library is actively used (387/1481 classes)." } ] }, @@ -12727,11 +12727,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, duration-only claim in a heavily loaded library." + "value": "High severity, moderate EPSS (0.21); acceptable duration-based claim." } ] }, @@ -12837,11 +12837,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE excused only by absence of observed execution." + "value": "High severity, low EPSS (0.11); acceptable duration-based claim." } ] }, @@ -12947,11 +12947,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, no code-level reachability finding, worth review." + "value": "High severity, very low EPSS (0.03); acceptable duration-based claim." } ] }, @@ -13061,7 +13061,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with an elevated EPSS (0.67), duration-only acceptance is weaker evidence." + "value": "High severity with elevated EPSS (0.67, 99.2th percentile); duration-only claim should be double-checked." } ] }, @@ -13167,11 +13167,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, duration-only justification, worth confirming reachability." + "value": "High severity but low EPSS (0.01); acceptable duration-based claim." } ] }, @@ -13281,7 +13281,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS 0.73, absence-of-execution justification only." + "value": "High severity with elevated EPSS (0.73, 99.4th percentile); duration-only claim warrants confirmation." } ] }, @@ -13387,11 +13387,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, duration-only reasoning in a heavily used library." + "value": "High severity but negligible EPSS; acceptable duration-based claim." } ] }, @@ -13497,11 +13497,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE excused only by 288 days without observed execution." + "value": "High severity, moderate EPSS (0.18); acceptable duration-based claim." } ] }, @@ -13607,11 +13607,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, no structural non-reachability guarantee." + "value": "High severity, low EPSS (0.05); acceptable duration-based claim." } ] }, @@ -13721,7 +13721,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with an elevated EPSS (0.57), duration-only acceptance warrants review." + "value": "High severity with elevated EPSS (0.57, 99.0th percentile); worth confirming rather than accepting absence-of-execution alone." } ] }, @@ -13827,11 +13827,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, duration-only justification." + "value": "High severity, low EPSS (0.03); acceptable duration-based claim." } ] }, @@ -13937,11 +13937,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, absence-of-execution reasoning only." + "value": "High severity, very low EPSS (0.02); acceptable duration-based claim." } ] }, @@ -14047,11 +14047,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, duration-only claim, worth confirming." + "value": "High severity, very low EPSS (0.02); acceptable duration-based claim." } ] }, @@ -14157,11 +14157,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE excused only by runtime silence." + "value": "High severity, very low EPSS (0.02); acceptable duration-based claim." } ] }, @@ -14267,11 +14267,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, duration-only reasoning in a widely used library." + "value": "High severity, very low EPSS (0.02); acceptable duration-based claim." } ] }, @@ -14381,7 +14381,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with an elevated EPSS (0.6), duration-only acceptance is weaker evidence." + "value": "High severity with elevated EPSS (0.6, 99.1th percentile); should be confirmed given active library usage." } ] }, @@ -14487,11 +14487,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, no structural reachability finding." + "value": "High severity, moderate EPSS (0.23); acceptable duration-based claim." } ] }, @@ -14601,7 +14601,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed HTTP/2 Rapid Reset CVE with EPSS at the maximum, excused only by absence of observed execution. Needs manual verification." + "value": "High severity, CISA KEV listed (HTTP/2 Rapid Reset), EPSS 1.0; duration-only reasoning is weak against a KEV entry with near-certain exploitation probability." } ] }, @@ -14707,11 +14707,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, duration-only justification." + "value": "High severity, moderate EPSS (0.21); acceptable duration-based claim." } ] }, @@ -14817,11 +14817,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE (7.3), absence-of-execution reasoning only." + "value": "High severity, low EPSS (0.03); acceptable duration-based claim." } ] }, @@ -14927,11 +14927,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE (7.0), duration-only claim in a heavily used library." + "value": "High severity, very low EPSS (0.01); acceptable duration-based claim." } ] }, @@ -15037,11 +15037,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, no code-level reachability finding." + "value": "High severity, low EPSS (0.09); acceptable duration-based claim." } ] }, @@ -15151,7 +15151,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with an elevated EPSS (0.57), duration-only acceptance warrants review." + "value": "High severity with elevated EPSS (0.57, 99.0th percentile); duration-only claim should be confirmed." } ] }, @@ -15261,7 +15261,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable duration-based claim." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -15371,7 +15371,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes despite an elevated EPSS of 0.46." + "value": "Medium severity; acceptable despite moderately elevated EPSS (0.46)." } ] }, @@ -15481,7 +15481,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable to rely on duration alone." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -15591,7 +15591,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity CVE, low stakes." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -15701,7 +15701,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable duration-based reasoning." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -15811,7 +15811,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, low stakes." + "value": "Medium severity, low EPSS; acceptable duration-based claim." } ] }, @@ -15921,7 +15921,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity CVE, acceptable as-is." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -16031,7 +16031,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, acceptable duration-based claim." + "value": "Medium severity, low EPSS; acceptable duration-based claim." } ] }, @@ -16141,7 +16141,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Classified medium severity despite a very high EPSS (0.94), so the lower CVSS score keeps the operational stakes lower even though this one is worth a spot check given the EPSS." + "value": "Medium severity (score 4.3) despite high EPSS (0.94); lower-stakes severity makes duration-based acceptance reasonable." } ] }, @@ -16249,7 +16249,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero of 102 classes loaded, structural fact regardless of critical severity." + "value": "code_not_reachable, 0 of 102 classes loaded; structurally sound regardless of critical severity." } ] }, @@ -16357,7 +16357,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, plexus-utils never loaded, safe to rely on." + "value": "code_not_reachable; structurally sound." } ] }, @@ -16465,7 +16465,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural exclusion." + "value": "code_not_reachable; structurally sound." } ] }, @@ -16573,7 +16573,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, low severity and structurally excluded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -16681,7 +16681,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero of 727 netty classes loaded, structural fact despite critical severity." + "value": "code_not_reachable, 0 of 727 classes loaded; structurally sound regardless of critical severity." } ] }, @@ -16789,7 +16789,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, netty never loaded, safe to trust." + "value": "code_not_reachable; structurally sound." } ] }, @@ -16897,7 +16897,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structurally excluded library." + "value": "code_not_reachable; structurally sound." } ] }, @@ -17005,7 +17005,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -17113,7 +17113,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, safe regardless of severity." + "value": "code_not_reachable; structurally sound." } ] }, @@ -17221,7 +17221,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, netty never loaded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -17329,7 +17329,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structural exclusion." + "value": "code_not_reachable; structurally sound." } ] }, @@ -17437,7 +17437,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, reliable." + "value": "code_not_reachable; structurally sound." } ] }, @@ -17545,7 +17545,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, safe to trust." + "value": "code_not_reachable; structurally sound." } ] }, @@ -17651,7 +17651,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, unscored severity, structurally excluded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -17759,7 +17759,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero of 81 jetty-http classes loaded, structural fact despite critical severity." + "value": "code_not_reachable, 0 of 81 classes loaded; structurally sound regardless of critical severity." } ] }, @@ -17867,7 +17867,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, safe to rely on." + "value": "code_not_reachable; structurally sound." } ] }, @@ -17975,7 +17975,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, jetty-http never loaded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -18083,7 +18083,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structurally excluded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -18191,7 +18191,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, low severity and structurally excluded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -18297,11 +18297,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity thymeleaf CVE, duration-only acceptance in a heavily used library (367 of 549 classes)." + "value": "Critical severity but negligible EPSS (0.0); acceptable duration-based claim." } ] }, @@ -18407,11 +18407,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE, same duration-only reasoning, same widely loaded library." + "value": "Critical severity but very low EPSS (0.01); acceptable duration-based claim." } ] }, @@ -18517,11 +18517,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE, absence-of-execution justification only." + "value": "Critical severity but very low EPSS (0.01); acceptable duration-based claim." } ] }, @@ -18627,11 +18627,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity mysql-connector-java CVE, duration-only claim." + "value": "High severity, low EPSS (0.04), minimal class usage (4/347); acceptable duration-based claim." } ] }, @@ -18737,11 +18737,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, absence-of-execution reasoning only." + "value": "High severity, very low EPSS (0.01); acceptable duration-based claim." } ] }, @@ -18851,7 +18851,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable duration-based claim." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -18959,7 +18959,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, low stakes." + "value": "Unknown severity; low stakes duration-based claim." } ] }, @@ -19067,7 +19067,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero of zero classes loaded, structural fact despite high severity." + "value": "code_not_reachable, 0 of 0 classes; structurally sound." } ] }, @@ -19173,11 +19173,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-boot CVE, duration-only acceptance in a loaded library (183 of 458 classes)." + "value": "High severity, very low EPSS (0.01); acceptable duration-based claim." } ] }, @@ -19283,11 +19283,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, no structural reachability finding." + "value": "High severity, negligible EPSS; acceptable duration-based claim." } ] }, @@ -19393,11 +19393,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, duration-only justification, though EPSS is very low." + "value": "High severity, negligible EPSS; acceptable duration-based claim." } ] }, @@ -19507,7 +19507,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable to rely on duration-based reasoning." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -19615,7 +19615,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero of 53 classes loaded, structural fact." + "value": "code_not_reachable, 0 of 53 classes loaded; structurally sound." } ] }, @@ -19723,7 +19723,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, neko-htmlunit never loaded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -19829,11 +19829,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity gson CVE with EPSS 0.12, duration-only acceptance in a loaded library (36 of 174 classes)." + "value": "High severity, moderate EPSS (0.12); acceptable duration-based claim given limited class usage (36/174)." } ] }, @@ -19941,7 +19941,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero of 200 commons-compress classes loaded, structural fact despite high severity." + "value": "code_not_reachable, 0 of 200 classes loaded; structurally sound." } ] }, @@ -20049,7 +20049,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structurally excluded library." + "value": "code_not_reachable; structurally sound." } ] }, @@ -20157,7 +20157,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, safe to trust." + "value": "code_not_reachable; structurally sound." } ] }, @@ -20265,7 +20265,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -20373,7 +20373,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, low severity and structurally excluded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -20481,7 +20481,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity and structurally excluded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -20591,7 +20591,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity xalan CVE with a notably elevated EPSS score (0.81), duration-only acceptance is weak here even though only 7 of 1501 classes are loaded, since it is still non-zero usage." + "value": "High severity with very elevated EPSS (0.81, 99.6th percentile) resting solely on absence-of-execution reasoning; worth a human check despite minimal class usage (7/1501)." } ] }, @@ -20697,11 +20697,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-core CVE, duration-only claim in a heavily loaded library (334 of 791 classes)." + "value": "High severity, low EPSS (0.03); acceptable duration-based claim." } ] }, @@ -20807,11 +20807,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, absence-of-execution reasoning only." + "value": "High severity, low EPSS (0.09); acceptable duration-based claim." } ] }, @@ -20917,11 +20917,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, duration-only justification, though EPSS is negligible." + "value": "High severity but negligible EPSS; acceptable duration-based claim." } ] }, @@ -21027,11 +21027,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, no code-level reachability finding." + "value": "High severity, low EPSS (0.03); acceptable duration-based claim." } ] }, @@ -21141,7 +21141,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable duration-based claim." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -21251,7 +21251,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes despite an elevated EPSS of 0.35." + "value": "Medium severity despite elevated EPSS (0.35); lower stakes make acceptance reasonable." } ] }, @@ -21361,7 +21361,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable to rely on as-is." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -21471,7 +21471,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, low stakes." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -21577,11 +21577,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-expression CVE, duration-only acceptance in a heavily used library (91 of 142 classes)." + "value": "High severity but negligible EPSS; acceptable duration-based claim." } ] }, @@ -21687,11 +21687,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, same duration-only reasoning." + "value": "High severity but negligible EPSS; acceptable duration-based claim." } ] }, @@ -21797,11 +21797,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE, absence-of-execution justification only." + "value": "High severity but negligible EPSS; acceptable duration-based claim." } ] }, @@ -21911,7 +21911,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable duration-based claim." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -22021,7 +22021,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low stakes." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -22131,7 +22131,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, elevated EPSS of 0.36 but lower CVSS keeps stakes manageable." + "value": "Medium severity despite elevated EPSS (0.36); lower stakes make acceptance reasonable." } ] }, @@ -22241,7 +22241,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, acceptable as-is." + "value": "Medium severity, negligible EPSS; acceptable." } ] }, @@ -22351,7 +22351,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low stakes for a duration-based claim." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -22457,11 +22457,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-boot-autoconfigure CVE, duration-only acceptance in a heavily loaded library (195 of 848 classes)." + "value": "High severity, very low EPSS (0.01); acceptable duration-based claim." } ] }, @@ -22571,7 +22571,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity tomcat-embed-websocket CVE, acceptable duration-based reasoning." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -22677,11 +22677,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity hibernate-core CVE, duration-only claim in an extremely heavily used library (1563 of 3787 classes)." + "value": "High severity, low EPSS (0.03); acceptable duration-based claim despite heavy class usage (1563/3787)." } ] }, @@ -22791,7 +22791,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable to rely on as-is." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -22897,11 +22897,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity hibernate-validator CVE, duration-only acceptance in a loaded library (225 of 459 classes)." + "value": "High severity but negligible EPSS (0.0); acceptable duration-based claim." } ] }, @@ -23007,11 +23007,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity guava CVE (7.1), duration-only justification, though EPSS is low." + "value": "High severity but negligible EPSS (0.0); acceptable duration-based claim." } ] }, @@ -23121,7 +23121,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, acceptable to rely on duration-based reasoning." + "value": "Low severity; acceptable duration-based claim." } ] }, @@ -23229,7 +23229,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, lower stakes despite an elevated EPSS of 0.17." + "value": "Unknown severity score; low stakes duration-based claim." } ] }, @@ -23337,7 +23337,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, lower stakes despite an elevated EPSS of 0.25." + "value": "Unknown severity score; low stakes duration-based claim." } ] }, @@ -23447,7 +23447,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, acceptable duration-based claim." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -23557,7 +23557,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low stakes." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -23667,7 +23667,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity spring-boot-actuator CVE, acceptable duration-based reasoning." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -23775,7 +23775,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero of zero classes loaded, structural fact." + "value": "code_not_reachable, 0 of 0 classes; structurally sound." } ] }, @@ -23883,7 +23883,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, bootstrap never loaded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -23991,7 +23991,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structurally excluded." + "value": "code_not_reachable; structurally sound." } ] }, @@ -24099,7 +24099,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, safe to trust regardless of elevated EPSS (0.16)." + "value": "code_not_reachable; structurally sound." } ] }, @@ -24207,7 +24207,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structurally excluded library." + "value": "code_not_reachable; structurally sound." } ] }, @@ -24315,7 +24315,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, safe to rely on." + "value": "code_not_reachable; structurally sound." } ] }, @@ -24423,7 +24423,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, junit never loaded, a test-scope dependency with no runtime path anyway." + "value": "code_not_reachable, 0 of 286 classes loaded; structurally sound." } ] }, @@ -24531,7 +24531,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable for commons-lang3, zero of 152 classes loaded, structurally sound (same CVE, separate library from the commons-lang entry above)." + "value": "code_not_reachable, 0 of 152 classes loaded (commons-lang3); structurally sound." } ] }, @@ -24639,7 +24639,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable for commons-lang3, zero of 152 classes loaded, structurally sound (same CVE, separate library from the commons-lang entry above)." + "value": "code_not_reachable, 0 of 152 classes loaded (commons-lang3); structurally sound." } ] }, @@ -24749,7 +24749,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity spring-data-jpa CVE, acceptable duration-based claim." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -24859,7 +24859,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low stakes." + "value": "Medium severity; acceptable duration-based claim." } ] }, @@ -24969,7 +24969,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity spring-context CVE, acceptable to rely on as-is." + "value": "Medium severity, low EPSS (0.06); acceptable duration-based claim." } ] }, @@ -25079,7 +25079,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity spring-context CVE, low stakes duration-based claim (separate library from the spring-web entry with the same CVE ID)." + "value": "Medium severity (spring-context); acceptable duration-based claim." } ] }, @@ -25189,7 +25189,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, lowest stakes of the spring-context claims." + "value": "Low severity; acceptable duration-based claim." } ] }, @@ -25297,7 +25297,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero of 466 httpclient classes loaded, structural fact." + "value": "code_not_reachable, 0 of 466 classes loaded; structurally sound." } ] }, @@ -25405,7 +25405,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, commons-io never loaded, safe to rely on." + "value": "code_not_reachable, 0 of 110 classes loaded; structurally sound." } ] }, @@ -25513,7 +25513,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, structurally excluded library." + "value": "code_not_reachable; structurally sound." } ] }, @@ -25623,7 +25623,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity jackson-core CVE, acceptable duration-based claim." + "value": "Medium severity, negligible EPSS; acceptable duration-based claim." } ] }, @@ -25731,7 +25731,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity, low stakes duration-based claim." + "value": "Unknown severity score; low stakes duration-based claim." } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index 4285f38..651f954 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -512,10 +512,10 @@ private String generateReport(List appResults, List entrie sb.append("**VEX** - `NA` = not_affected, `IT` = in_triage\n\n"); sb.append("**Rationale** - why the claim was made, with the day count for the two duration-based reasons:\n\n"); sb.append("| Rationale | Meaning |\n|-----------|---------|\n"); - sb.append("| `Unused` | Library never loaded at runtime (0 classes) - structural, not time-based |\n"); - sb.append("| `Shielded` | CVE Shield/Protect actively mitigating at runtime - an active control, not time-based |\n"); - sb.append("| `Aged Nd` | not_affected on N days without observed execution alone, past the acceptance threshold |\n"); - sb.append("| `Watching Nd` | in_triage - N days without observed execution so far, still short of the acceptance threshold |\n\n"); + sb.append("| `Library Unused` | Library never loaded at runtime (0 classes) - structural, not time-based |\n"); + sb.append("| `CVE Shielded` | CVE Shield/Protect actively mitigating at runtime - an active control, not time-based |\n"); + sb.append("| `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold |\n"); + sb.append("| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold |\n\n"); sb.append("Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth ") .append("a second look surface at the top - see the Key Findings above for which specific CVEs those are.\n"); @@ -581,12 +581,12 @@ private String generateReport(List appResults, List entrie return sb.toString(); } - /** Unused/Shielded are structural; Aged/Watching are duration-based and carry the day count. */ + /** Library Unused/CVE Shielded are structural; CVE Not Used/CVE Watching are duration-based and carry the day count. */ private String rationaleWord(VexStatement s) { - if ("code_not_reachable".equals(s.justification)) return "Unused"; - if ("protected_at_runtime".equals(s.justification)) return "Shielded"; - if ("in_triage".equals(s.state)) return "Watching " + s.daysObserved + "d"; - return "Aged " + s.daysObserved + "d"; + if ("code_not_reachable".equals(s.justification)) return "Library Unused"; + if ("protected_at_runtime".equals(s.justification)) return "CVE Shielded"; + if ("in_triage".equals(s.state)) return "CVE Watching " + s.daysObserved + "d"; + return "CVE Not Used " + s.daysObserved + "d"; } /** Strips a purl down to "artifact@version" - drops the "pkg:maven//" prefix for a narrow column. */ From c7d00a6814ab4bd3be321ca978022674b6bc3d92 Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 22:14:19 -0400 Subject: [PATCH 11/16] Report Assess/Protect module enablement per app/environment in VEX Adds a fourth data source to VEXGenerator - GET /Contrast/api/ng/{org}/applications/{id}/servers - which exposes per-server, per-environment `assess` and `defend` enablement flags. Surfaced as a new Application component (bom.components[], one per app, not repeated per statement) with contrast:assessEnabledDev/Qa/Prod and contrast:protectEnabledDev/Qa/Prod properties ("true"/"false"/"" - empty means no agent was ever seen in that environment, a different fact from "disabled"). This closes a real gap: a duration-based not_affected claim scoped to an environment where Assess itself has no data isn't weak evidence, it's no evidence at all - the tool had no way to say so. For SAML-PetClinic-Demo this is concrete: Assess has no data for QA at all, and Protect is disabled in dev despite being enabled in prod. Named `protectEnabled*`, not `shieldEnabled*` - went through two corrections getting here. First cut conflated "CVE Shield" with the API's `defend` flag, which is actually the older, separate HTTP-rule RASP module (Protect). CVE Shield is a newer product that defends specific CVEs via a microsandbox, and there is no distinct enablement flag for it anywhere in this API - so this reports Assess/Protect only, and says so explicitly in the Legend, the doc comments, and the VEX Advisor's prompt/report, rather than fabricating an "ADR" or "CVE Shield enabled" signal that doesn't exist. CVE Shield's own per-CVE verdicts (PROTECTING/BLOCKED) still surface as they always did, via the protected_at_runtime justification and devStatus/qaStatus/ prodStatus properties. VEXAdvisor: parses the new component properties into AppEntry, adds a per-app "Protection Status" line to the report, and feeds the enablement facts into the AI prompt so duration-based claims in an Assess-blind environment get flagged regardless of severity. Regenerated samples/sample-vex.json and sample-vex-advisor.md against SAML-PetClinic-Demo; re-validated against the CycloneDX 1.6 schema. --- README.md | 4 +- samples/sample-vex-advisor.md | 18 +- samples/sample-vex.json | 741 ++++++++++-------- .../runtimeanalyst/VEXAdvisor.java | 55 +- .../runtimeanalyst/VEXGenerator.java | 102 ++- 5 files changed, 564 insertions(+), 356 deletions(-) diff --git a/README.md b/README.md index a814079..b422831 100644 --- a/README.md +++ b/README.md @@ -208,6 +208,8 @@ A standard CycloneDX 1.6 document with a top-level `vulnerabilities[]` array, on All of the above is deterministic, pulled directly from Contrast's own CVE/library data - nothing here is AI-generated, since a VEX claim is an attestation and needs to stay auditable back to its source evidence. The EPSS/CISA KEV signals are new inputs to the **VEX Advisor**'s AI judgment (below), not to the claim itself. +The document also has a top-level `components[]` array with one Application component per app, carrying whether Assess (the module that produces every claim's runtime evidence) and Protect (the classic HTTP-rule-based RASP module) are enabled per environment: `contrast:assessEnabledDev`/`Qa`/`Prod` and `contrast:protectEnabledDev`/`Qa`/`Prod` (`"true"`/`"false"`/`""` - empty means no agent was ever seen reporting from that environment, which is a different fact from "disabled"). This is *not* CVE Shield - Contrast's API exposes no separate enablement flag for CVE Shield, a newer product that defends specific CVEs via a microsandbox rather than HTTP rules, so this tool doesn't claim to report on it. CVE Shield's own per-CVE verdicts still show up per-claim as the `protected_at_runtime` justification (from the same `PROTECTING`/`BLOCKED` statuses the `devStatus`/`qaStatus`/`prodStatus` properties already carry) - this new data adds the missing "was anything even watching" context around those claims, not a duplicate of them. + ``` Contrast VEX └── SAML-PetClinic-Demo @@ -221,7 +223,7 @@ Note: `PROTECTED_AT_RUNTIME` (CVE Shield/Protect actively mitigating) is impleme - **Quantum Advisor** - findings grouped by risk level (CRITICAL/HIGH/MEDIUM/LOW/NOT_QUANTUM_ISSUE), with an "Application Context" section describing each app from its architecture graph data - **AI Advisor** - organized as an inventory of AI-enabled applications (one section per app, not per finding): an AI-generated description of what the app does, then each AI usage instance with model/provider/endpoint and a description of what that specific call is doing, inferred from the key methods around it in the stack trace -- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Rationale`, e.g. `CVE Not Used 288d` or `Library Unused` - decoded in a legend) instead of a full-sentence rationale repeated per claim. Rows sort CISA KEV-listed first, then by EPSS, then by CVSS score, so the claims worth a second look surface at the top without needing a separate flag column - there's no distinct action per severity tier (the real options, verify reachability or upgrade, are the same regardless), so the report doesn't pretend otherwise with a column that can't back it up. +- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Rationale`, e.g. `CVE Not Used 288d` or `Library Unused` - decoded in a legend) instead of a full-sentence rationale repeated per claim. Rows sort CISA KEV-listed first, then by EPSS, then by CVSS score, so the claims worth a second look surface at the top without needing a separate flag column - there's no distinct action per severity tier (the real options, verify reachability or upgrade, are the same regardless), so the report doesn't pretend otherwise with a column that can't back it up. Each app's section also shows a **Protection Status** line (Assess/Protect enablement per environment, from the VEX's own `components[]` - see above) and feeds it to the AI: a duration-based claim in an environment where Assess has no data isn't weak evidence, it's *no* evidence, regardless of the CVE's severity. Both the Quantum and AI Advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component. The VEX Advisor writes `contrast:vexAdvisorAssessment` (`sound`/`needs_review`) and `contrast:vexAdvisorRationale` back onto each vulnerability's `properties[]`. All of this happens automatically as part of every `--analyze` run, no separate step needed. diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index 795f74a..6cbfa10 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -18,7 +18,7 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated **Key Findings:** -- **21 of 235 claim(s) flagged for human review** before relying on them. +- **125 of 235 claim(s) flagged for human review** before relying on them. - **8 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. - **10 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+4 more). - Application(s) rated CRITICAL/HIGH risk: SAML-PetClinic-Demo. @@ -27,11 +27,11 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated | Application | Risk Level | Statements | |-------------|------------|------------| -| SAML-PetClinic-Demo | HIGH | 235 | +| SAML-PetClinic-Demo | CRITICAL | 235 | | Risk Level | Applications | |------------|--------------| -| HIGH | 1 | +| CRITICAL | 1 | ### Legend @@ -48,19 +48,23 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth a second look surface at the top - see the Key Findings above for which specific CVEs those are. +**Protection Status** (shown per app below) - Assess is the module that produces the runtime evidence every claim in this report rests on; Protect is the classic HTTP-rule-based RASP module. Neither is CVE Shield - CVE Shield is a separate, newer product that defends specific CVEs via a microsandbox rather than HTTP rules, and Contrast's API exposes no distinct enablement flag for it. CVE Shield's own per-CVE verdicts still show up per-claim above as the `CVE Shielded` rationale. + --- ## Application Detail ### SAML-PetClinic-Demo -**Risk Level:** HIGH +**Risk Level:** CRITICAL + +**Protection Status:** Assess (runtime evidence): dev=enabled, qa=no data, prod=enabled · Protect (classic RASP, not CVE Shield): dev=disabled, qa=no data, prod=enabled -SAML-PetClinic-Demo carries roughly 300 VEX claims spanning ~40 libraries, almost entirely dev/qa/prod runtime data collected over 288 days (well past the 30-day acceptance threshold). The large majority are either structurally sound (code_not_reachable, zero classes loaded) or duration-based acceptances on CVEs with low exploitability signals, but a meaningful subset of duration-only claims sit on CRITICAL/HIGH CVEs with very high EPSS or CISA KEV status, which is a materially weaker basis for 'not_affected.' +SAML-PetClinic-Demo has roughly 240 VEX claims across ~30 libraries, generated from 288 days of Contrast runtime observation (Assess enabled in dev/prod, no data in qa; Protect/RASP enabled in prod but disabled in dev). About 90 claims rest on genuine structural evidence (code_not_reachable, 0 classes ever loaded) and are safe to trust as-is. The remaining ~150 claims, including several CRITICAL/KEV CVEs (Spring4Shell CVE-2022-22965 across three libraries, GhostCat CVE-2020-1938, Tomcat CVE-2025-24813/2017-12617/2023-44487, and spring-data-commons CVE-2018-1273 with EPSS 0.97), are 'not_affected' purely because the vulnerable path hasn't fired in 288 days - a probabilistic absence-of-evidence argument, not a structural guarantee. -**Risk Rationale:** 20 claims rely on 'absence of observed execution' alone to dismiss CVEs that are either in the CISA KEV catalog (e.g. CVE-2022-22965/Spring4Shell across spring-beans/spring-webmvc, CVE-2020-1938/Ghostcat, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487 in tomcat-embed-core, CVE-2018-1273 in spring-data-commons) or carry near-certain EPSS scores (0.5-1.0) on critical/high severity findings (e.g. CVE-2019-0232, CVE-2019-0199, CVE-2019-10072, CVE-2020-9484, CVE-2024-50379, CVE-2022-34169). These libraries (tomcat-embed-core, spring-webmvc, spring-beans) show substantial class loading (166-387 classes used), meaning the code is actively exercised and 'the vulnerable path hasn't fired yet' is a probabilistic, not structural, claim. Everything justified by code_not_reachable (0 classes loaded) is sound regardless of severity, and duration-only claims on medium/low severity or low-EPSS critical/high CVEs are reasonable as-is. +**Risk Rationale:** Multiple KEV-listed, actively-exploited CVEs (CVE-2022-22965 Spring4Shell on spring-boot-starter-web/spring-webmvc/spring-beans, CVE-2020-1938 GhostCat, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487, and CVE-2018-1273 with EPSS 0.97) are all being waived on duration-only reasoning rather than code_not_reachable or protected_at_runtime. Given that Protect (RASP) is disabled in dev, there is no active backstop control there if any of this reasoning is wrong, and dozens of other CRITICAL/HIGH jackson-databind and tomcat-embed-core CVEs share the same weak justification pattern at scale. None of the Assess/Protect enablement data by itself invalidates the evidence (dev and prod both have Assess data), but the sheer number of severe, duration-only claims - several tied to CVEs with public exploits in the KEV catalog - makes this VEX set unsafe to rely on without human review of the highest-severity items. -**Recommendation:** Have a human reviewer specifically re-examine the 20 flagged CVEs below before treating them as closed, prioritizing the four KEV-listed findings on spring-beans/spring-webmvc (CVE-2022-22965) and tomcat-embed-core (CVE-2020-1938, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487) plus CVE-2018-1273, given their combination of severity, exploitability, and confirmed active code loading. All code_not_reachable claims can be trusted as-is. +**Recommendation:** Prioritize human review of every KEV-listed or EPSS>0.3 CVE relying on duration-only justification, especially CVE-2022-22965 (all three libraries), CVE-2020-1938, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487, and CVE-2018-1273. For these, either confirm code-level unreachability manually, add compensating controls (e.g., enable Protect in dev), or escalate to patch given the low cost/high benefit of upgrading jackson-databind, tomcat-embed-core, and the Spring stack. The code_not_reachable claims (htmlunit, snakeyaml, netty, jetty-http, plexus-utils, commons-compress, bootstrap, junit, commons-lang/commons-lang3, commons-io, httpclient, neko-htmlunit) can be trusted as-is. Medium/low/unknown-severity duration-based claims are acceptable without further action. | CVE | Library | Score | VEX | Rationale | |-----|---------|-------|-----|-----------| diff --git a/samples/sample-vex.json b/samples/sample-vex.json index bd1e181..a4cd6ea 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -3,13 +3,72 @@ "specVersion": "1.6", "version": 1, "metadata": { - "timestamp": "2026-09-03T01:52:49Z", + "timestamp": "2026-09-03T02:10:38Z", "component": { "type": "application", "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", - "name": "SAML-PetClinic-Demo" + "name": "SAML-PetClinic-Demo", + "properties": [ + { + "name": "contrast:assessEnabledDev", + "value": "true" + }, + { + "name": "contrast:assessEnabledQa", + "value": "" + }, + { + "name": "contrast:assessEnabledProd", + "value": "true" + }, + { + "name": "contrast:protectEnabledDev", + "value": "false" + }, + { + "name": "contrast:protectEnabledQa", + "value": "" + }, + { + "name": "contrast:protectEnabledProd", + "value": "true" + } + ] } }, + "components": [ + { + "type": "application", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", + "name": "SAML-PetClinic-Demo", + "properties": [ + { + "name": "contrast:assessEnabledDev", + "value": "true" + }, + { + "name": "contrast:assessEnabledQa", + "value": "" + }, + { + "name": "contrast:assessEnabledProd", + "value": "true" + }, + { + "name": "contrast:protectEnabledDev", + "value": "false" + }, + { + "name": "contrast:protectEnabledQa", + "value": "" + }, + { + "name": "contrast:protectEnabledProd", + "value": "true" + } + ] + } + ], "vulnerabilities": [ { "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14721-bf88c7b27e95cbadce4e7c316a56c3efffda8026", @@ -113,11 +172,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but EPSS is low (0.1) and 288 days comfortably exceeds threshold; reasonable duration-based acceptance." + "value": "Critical severity jackson-databind CVE waived on 288-day absence-of-execution only, no structural non-reachability guarantee." } ] }, @@ -223,11 +282,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but EPSS is very low (0.06); duration-based acceptance is reasonable." + "value": "Critical severity, duration-only justification; should be manually confirmed before relying on it." } ] }, @@ -337,7 +396,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with elevated EPSS (0.5, 98.8th percentile) relying solely on absence-of-execution; library is actively loaded (263/582 classes), so this warrants human confirmation." + "value": "Critical severity with elevated EPSS (0.5, 98.81 pct); duration-only absence-of-execution reasoning is weak evidence for this exploitability profile." } ] }, @@ -443,11 +502,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, EPSS 0.27 is moderate; duration-based acceptance is within reasonable bounds." + "value": "Critical severity, duration-only justification with no code_not_reachable backing." } ] }, @@ -553,11 +612,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but EPSS very low (0.05); duration-based acceptance reasonable." + "value": "Critical severity CVE accepted purely on non-execution duration; warrants confirmation." } ] }, @@ -663,11 +722,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.09); acceptable duration-based claim." + "value": "Critical severity, duration-based claim only; not a structural guarantee." } ] }, @@ -773,11 +832,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.13); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -883,11 +942,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.08); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -993,11 +1052,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.1); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -1103,11 +1162,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, moderate EPSS (0.18); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -1213,11 +1272,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.11); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -1323,11 +1382,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, moderate EPSS (0.18); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -1433,11 +1492,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.06); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -1543,11 +1602,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.06); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -1653,11 +1712,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.11); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -1763,11 +1822,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.05); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -1873,11 +1932,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.11); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -1983,11 +2042,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.11); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -2093,11 +2152,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.05); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -2207,7 +2266,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with elevated EPSS (0.38, 98.4th percentile) resting solely on absence-of-execution over an actively loaded library; worth confirming." + "value": "Critical severity with meaningful EPSS (0.38, 98.44 pct); duration-only claim is weaker evidence here." } ] }, @@ -2313,11 +2372,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, moderate EPSS (0.2); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -2423,11 +2482,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.05); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -2533,11 +2592,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.08); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -2643,11 +2702,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, low EPSS (0.08); acceptable duration-based claim." + "value": "Critical severity, duration-only reasoning; should be reviewed." } ] }, @@ -2753,11 +2812,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.08); acceptable duration-based claim." + "value": "High severity CVE waived solely on non-execution duration." } ] }, @@ -2863,11 +2922,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.13); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -2973,11 +3032,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.09); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -3083,11 +3142,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.08); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -3193,11 +3252,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.1); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -3303,11 +3362,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -3413,11 +3472,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -3523,11 +3582,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -3633,11 +3692,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -3743,11 +3802,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, moderate EPSS (0.21); acceptable duration-based claim." + "value": "High severity with EPSS 0.21 (97.39 pct); duration-only claim should be verified." } ] }, @@ -3853,11 +3912,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.03); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -3963,11 +4022,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -4073,11 +4132,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.11); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -4183,11 +4242,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -4293,11 +4352,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -4403,11 +4462,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -4513,11 +4572,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.07); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -4623,11 +4682,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.07); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -4733,11 +4792,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.09); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -4843,11 +4902,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.07); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -4953,11 +5012,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.03); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -5063,11 +5122,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.03); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -5173,11 +5232,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, moderate EPSS (0.18); acceptable duration-based claim." + "value": "High severity with EPSS 0.18; duration-only justification warrants review." } ] }, @@ -5283,11 +5342,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.09); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -5393,11 +5452,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -5503,11 +5562,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.11); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -5613,11 +5672,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.07); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -5723,11 +5782,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, moderate EPSS (0.22); acceptable duration-based claim." + "value": "High severity with EPSS 0.22; duration-only justification warrants review." } ] }, @@ -5837,7 +5896,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; lower stakes make duration-based acceptance reasonable even with elevated EPSS." + "value": "Medium severity accepted on duration alone; lower stakes if wrong, acceptable as-is despite elevated EPSS." } ] }, @@ -5947,7 +6006,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance is fine at this risk tier." + "value": "Medium severity accepted on duration alone; acceptable as-is." } ] }, @@ -6055,7 +6114,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable with 0 of 1295 classes loaded; a structural fact, safe regardless of critical severity." + "value": "code_not_reachable with 0 of 1295 classes ever loaded - a structural fact regardless of critical severity." } ] }, @@ -6163,7 +6222,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; structurally sound." + "value": "code_not_reachable, 0 classes loaded; structural non-reachability holds regardless of severity." } ] }, @@ -6269,11 +6328,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but EPSS low (0.07) and only 1 of 190 classes ever loaded, suggesting minimal library surface exercised; acceptable." + "value": "Critical severity dom4j CVE; only 1 of 190 classes loaded but claim rests on duration, not code_not_reachable - worth confirming the loaded class isn\u0027t the vulnerable one." } ] }, @@ -6379,11 +6438,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.07); acceptable duration-based claim." + "value": "High severity, duration-only justification despite minimal library usage." } ] }, @@ -6491,7 +6550,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 206 classes loaded; structurally sound despite critical severity and very high EPSS (1.0)." + "value": "code_not_reachable, 0 of 206 classes loaded - structural fact holds even given critical severity and EPSS 1.0/KEV-adjacent profile." } ] }, @@ -6599,7 +6658,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe as-is." + "value": "code_not_reachable; structural non-reachability, safe to trust." } ] }, @@ -6707,7 +6766,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe as-is." + "value": "code_not_reachable; structural non-reachability, safe to trust." } ] }, @@ -6815,7 +6874,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe as-is." + "value": "code_not_reachable; structural non-reachability, safe to trust." } ] }, @@ -6923,7 +6982,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe as-is." + "value": "code_not_reachable; structural non-reachability, safe to trust." } ] }, @@ -7031,7 +7090,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe as-is." + "value": "code_not_reachable; structural non-reachability, safe to trust." } ] }, @@ -7139,7 +7198,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe as-is." + "value": "code_not_reachable; structural non-reachability, safe to trust." } ] }, @@ -7247,7 +7306,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe as-is." + "value": "code_not_reachable; structural non-reachability, safe to trust." } ] }, @@ -7355,7 +7414,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, CISA KEV listed, EPSS 1.0, with 202 of 408 classes of spring-beans actively loaded; duration-only claim on a KEV entry with this much surface exercised should be verified." + "value": "spring-beans: KEV-listed critical Spring4Shell CVE waived on duration only, with 202 of 408 classes actively loaded - warrants confirmation." } ] }, @@ -7465,7 +7524,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, CISA KEV listed, EPSS near-certain (0.97), with 152 of 554 classes actively loaded; a pure absence-of-execution claim is a weak basis to dismiss this and should be confirmed by a human." + "value": "KEV-listed critical CVE with EPSS 0.97 waived purely on 288-day duration reasoning, not code_not_reachable; this is exactly the highest-stakes pattern to double-check." } ] }, @@ -7571,11 +7630,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but very low EPSS (0.02); acceptable duration-based claim." + "value": "High severity, duration-only justification on same actively-loaded library as the KEV CVE above." } ] }, @@ -7681,11 +7740,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but essentially zero EPSS (0.0); acceptable duration-based claim." + "value": "High severity, duration-only justification; low EPSS somewhat mitigates but still worth a look given severity." } ] }, @@ -7795,7 +7854,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable." + "value": "Medium severity accepted on duration alone with near-zero EPSS; acceptable as-is." } ] }, @@ -7905,7 +7964,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable." + "value": "Medium severity accepted on duration alone with near-zero EPSS; acceptable as-is." } ] }, @@ -8013,7 +8072,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown/no severity score; low stakes duration-based claim is acceptable." + "value": "Severity unrated (0.0); duration-only acceptance is low-stakes here." } ] }, @@ -8119,11 +8178,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but low EPSS (0.04); acceptable duration-based claim." + "value": "Critical severity hsqldb CVE waived on duration only, with substantial library usage (229 of 601 classes) increasing uncertainty about whether the vulnerable path was truly untriggered." } ] }, @@ -8229,11 +8288,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity (logback-classic), low EPSS (0.08); acceptable duration-based claim." + "value": "logback-classic: critical severity, duration-only justification." } ] }, @@ -8339,11 +8398,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity (logback-classic), very low EPSS (0.01); acceptable." + "value": "logback-classic: high severity, duration-only justification." } ] }, @@ -8453,7 +8512,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity accepted on duration alone; acceptable as-is." } ] }, @@ -8561,7 +8620,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS; low stakes." + "value": "Severity unrated; duration-only acceptance is low-stakes." } ] }, @@ -8669,7 +8728,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS; low stakes." + "value": "Severity unrated; duration-only acceptance is low-stakes." } ] }, @@ -8777,7 +8836,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS; low stakes." + "value": "Severity unrated; duration-only acceptance is low-stakes." } ] }, @@ -8885,7 +8944,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS; low stakes." + "value": "Severity unrated; duration-only acceptance is low-stakes." } ] }, @@ -8993,7 +9052,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS; low stakes." + "value": "Severity unrated; duration-only acceptance is low-stakes." } ] }, @@ -9101,7 +9160,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS; low stakes." + "value": "Severity unrated; duration-only acceptance is low-stakes." } ] }, @@ -9211,7 +9270,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with elevated EPSS (0.32) on an actively-loaded library (211/559 classes); duration-only reasoning is weaker here and merits confirmation." + "value": "spring-web: critical severity with meaningful EPSS (0.32); duration-only justification warrants review." } ] }, @@ -9317,11 +9376,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.04); acceptable duration-based claim." + "value": "spring-web: high severity, duration-only justification." } ] }, @@ -9427,11 +9486,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.01); acceptable." + "value": "spring-web: high severity, duration-only justification." } ] }, @@ -9537,11 +9596,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable." + "value": "spring-web: high severity, duration-only justification." } ] }, @@ -9651,7 +9710,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity accepted on duration alone; acceptable as-is." } ] }, @@ -9761,7 +9820,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity (spring-context); acceptable duration-based claim." + "value": "spring-context: medium severity, duration-only acceptance is low-stakes." } ] }, @@ -9871,7 +9930,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity accepted on duration alone; acceptable as-is." } ] }, @@ -9981,7 +10040,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, CISA KEV listed, EPSS 1.0, with 202 of 408 classes of spring-beans actively loaded; duration-only claim on a KEV entry with this much surface exercised should be verified." + "value": "spring-beans: KEV-listed critical Spring4Shell CVE waived on duration only, with 202 of 408 classes actively loaded - warrants confirmation." } ] }, @@ -10087,11 +10146,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but zero EPSS; acceptable duration-based claim." + "value": "High severity, duration-only justification on an actively-used library." } ] }, @@ -10201,7 +10260,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with notably elevated EPSS (0.55, 98.9th percentile) on an actively loaded library; duration-only reasoning should be double-checked." + "value": "High severity with elevated EPSS (0.55); duration-only justification should be confirmed." } ] }, @@ -10311,7 +10370,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -10421,7 +10480,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -10531,7 +10590,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -10641,7 +10700,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -10751,7 +10810,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -10861,7 +10920,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -10971,7 +11030,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -11081,7 +11140,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; duration-based claim is fine." + "value": "Low severity, duration-only acceptance is low-stakes." } ] }, @@ -11187,11 +11246,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity (logback-classic), low EPSS (0.08); acceptable duration-based claim." + "value": "logback-classic: critical severity, duration-only justification." } ] }, @@ -11297,11 +11356,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity (logback-classic), very low EPSS (0.01); acceptable." + "value": "logback-classic: high severity, duration-only justification." } ] }, @@ -11411,7 +11470,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, CISA KEV listed, EPSS 1.0, with 202 of 408 classes of spring-beans actively loaded; duration-only claim on a KEV entry with this much surface exercised should be verified." + "value": "spring-beans: KEV-listed critical Spring4Shell CVE waived on duration only, with 202 of 408 classes actively loaded - warrants confirmation." } ] }, @@ -11521,7 +11580,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS (0.02); acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -11627,11 +11686,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, moderate EPSS (0.22); acceptable duration-based claim." + "value": "tomcat-embed-core: critical severity, duration-only justification with EPSS 0.22." } ] }, @@ -11741,7 +11800,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, CISA KEV listed, EPSS 1.0, with substantial library usage (387/1481 classes); a duration-only claim on a KEV, near-certain-EPSS CVE against actively used code should be confirmed by a human." + "value": "KEV-listed critical Tomcat RCE with EPSS 1.0, waived purely on non-execution duration - highest-priority item to confirm manually." } ] }, @@ -11847,11 +11906,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but very low EPSS (0.01); acceptable duration-based claim." + "value": "Critical severity, duration-only justification." } ] }, @@ -11961,7 +12020,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, CISA KEV listed (Ghostcat), EPSS near-certain (0.99); duration-only reasoning against an actively loaded library warrants review." + "value": "KEV-listed critical GhostCat vulnerability with EPSS 0.99, waived on duration alone - should be manually verified, not left as-is." } ] }, @@ -12067,11 +12126,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but low EPSS (0.04); acceptable duration-based claim." + "value": "Critical severity, duration-only justification." } ] }, @@ -12181,7 +12240,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with elevated EPSS (0.44, 98.7th percentile) on an actively loaded library; should be confirmed rather than relying on absence of observed execution alone." + "value": "Critical severity with elevated EPSS (0.44); duration-only justification warrants review." } ] }, @@ -12287,11 +12346,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but very low EPSS (0.01); acceptable duration-based claim." + "value": "Critical severity, duration-only justification." } ] }, @@ -12401,7 +12460,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS at 1.0 (99.95th percentile); despite no KEV listing, this near-certain exploitation probability against actively loaded code warrants human confirmation." + "value": "High severity with EPSS 1.0; duration-only claim should be verified." } ] }, @@ -12511,7 +12570,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, CISA KEV listed, EPSS 1.0; duration-only reasoning is a weak basis given both KEV status and near-certain exploitation probability." + "value": "KEV-listed high severity RCE with EPSS 1.0, waived purely on duration - should be manually confirmed." } ] }, @@ -12621,7 +12680,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.73, 99.4th percentile); worth confirming given the library is actively used (387/1481 classes)." + "value": "High severity with elevated EPSS (0.73); duration-only justification warrants review." } ] }, @@ -12727,11 +12786,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, moderate EPSS (0.21); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -12837,11 +12896,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.11); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -12947,11 +13006,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.03); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -13061,7 +13120,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.67, 99.2th percentile); duration-only claim should be double-checked." + "value": "High severity with elevated EPSS (0.67); duration-only justification warrants review." } ] }, @@ -13167,11 +13226,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but low EPSS (0.01); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -13281,7 +13340,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.73, 99.4th percentile); duration-only claim warrants confirmation." + "value": "High severity with elevated EPSS (0.73); duration-only justification warrants review." } ] }, @@ -13387,11 +13446,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but negligible EPSS; acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -13497,11 +13556,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, moderate EPSS (0.18); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -13607,11 +13666,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.05); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -13721,7 +13780,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.57, 99.0th percentile); worth confirming rather than accepting absence-of-execution alone." + "value": "High severity with elevated EPSS (0.57); duration-only justification warrants review." } ] }, @@ -13827,11 +13886,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -13937,11 +13996,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.02); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -14047,11 +14106,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.02); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -14157,11 +14216,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.02); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -14267,11 +14326,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.02); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -14381,7 +14440,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.6, 99.1th percentile); should be confirmed given active library usage." + "value": "High severity with elevated EPSS (0.6); duration-only justification warrants review." } ] }, @@ -14487,11 +14546,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, moderate EPSS (0.23); acceptable duration-based claim." + "value": "High severity with EPSS 0.23; duration-only justification warrants review." } ] }, @@ -14601,7 +14660,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, CISA KEV listed (HTTP/2 Rapid Reset), EPSS 1.0; duration-only reasoning is weak against a KEV entry with near-certain exploitation probability." + "value": "KEV-listed HTTP/2 Rapid Reset CVE with EPSS 1.0, waived purely on duration - should be manually confirmed given active exploitation." } ] }, @@ -14707,11 +14766,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, moderate EPSS (0.21); acceptable duration-based claim." + "value": "High severity with EPSS 0.21; duration-only justification warrants review." } ] }, @@ -14817,11 +14876,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -14927,11 +14986,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.01); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -15037,11 +15096,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.09); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -15151,7 +15210,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.57, 99.0th percentile); duration-only claim should be confirmed." + "value": "High severity with elevated EPSS (0.57); duration-only justification warrants review." } ] }, @@ -15261,7 +15320,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -15371,7 +15430,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable despite moderately elevated EPSS (0.46)." + "value": "Medium severity, duration-only acceptance is low-stakes despite EPSS 0.46." } ] }, @@ -15481,7 +15540,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -15591,7 +15650,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -15701,7 +15760,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -15811,7 +15870,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -15921,7 +15980,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -16031,7 +16090,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -16141,7 +16200,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity (score 4.3) despite high EPSS (0.94); lower-stakes severity makes duration-based acceptance reasonable." + "value": "Medium severity, duration-only acceptance is low-stakes despite high EPSS (0.94)." } ] }, @@ -16249,7 +16308,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 102 classes loaded; structurally sound regardless of critical severity." + "value": "code_not_reachable, 0 of 102 classes loaded - structural fact regardless of critical severity." } ] }, @@ -16357,7 +16416,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds even for high severity." } ] }, @@ -16465,7 +16524,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -16573,7 +16632,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -16681,7 +16740,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 727 classes loaded; structurally sound regardless of critical severity." + "value": "code_not_reachable, 0 of 727 classes loaded - structural fact regardless of critical severity." } ] }, @@ -16789,7 +16848,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -16897,7 +16956,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -17005,7 +17064,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -17113,7 +17172,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -17221,7 +17280,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -17329,7 +17388,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -17437,7 +17496,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -17545,7 +17604,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -17651,7 +17710,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -17759,7 +17818,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 81 classes loaded; structurally sound regardless of critical severity." + "value": "code_not_reachable, 0 of 81 classes loaded - structural fact regardless of critical severity." } ] }, @@ -17867,7 +17926,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -17975,7 +18034,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -18083,7 +18142,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -18191,7 +18250,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -18297,11 +18356,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but negligible EPSS (0.0); acceptable duration-based claim." + "value": "Critical severity thymeleaf CVE, duration-only justification despite 367 of 549 classes actively loaded." } ] }, @@ -18407,11 +18466,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but very low EPSS (0.01); acceptable duration-based claim." + "value": "Critical severity, duration-only justification." } ] }, @@ -18517,11 +18576,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity but very low EPSS (0.01); acceptable duration-based claim." + "value": "Critical severity, duration-only justification." } ] }, @@ -18627,11 +18686,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.04), minimal class usage (4/347); acceptable duration-based claim." + "value": "High severity mysql-connector-java CVE, duration-only justification." } ] }, @@ -18737,11 +18796,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.01); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -18851,7 +18910,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -18959,7 +19018,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity; low stakes duration-based claim." + "value": "Severity unrated; duration-only acceptance is low-stakes." } ] }, @@ -19067,7 +19126,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 0 classes; structurally sound." + "value": "code_not_reachable, 0 of 0 classes loaded - structural fact even for high severity." } ] }, @@ -19173,11 +19232,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.01); acceptable duration-based claim." + "value": "High severity spring-boot CVE, duration-only justification." } ] }, @@ -19283,11 +19342,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS; acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -19393,11 +19452,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, negligible EPSS; acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -19507,7 +19566,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -19615,7 +19674,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 53 classes loaded; structurally sound." + "value": "code_not_reachable, 0 of 53 classes loaded - structural fact." } ] }, @@ -19723,7 +19782,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -19829,11 +19888,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, moderate EPSS (0.12); acceptable duration-based claim given limited class usage (36/174)." + "value": "High severity gson CVE with elevated EPSS (0.12); duration-only justification warrants review." } ] }, @@ -19941,7 +20000,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 200 classes loaded; structurally sound." + "value": "code_not_reachable, 0 of 200 classes loaded - structural fact even for high severity." } ] }, @@ -20049,7 +20108,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -20157,7 +20216,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -20265,7 +20324,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -20373,7 +20432,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -20481,7 +20540,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -20591,7 +20650,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with very elevated EPSS (0.81, 99.6th percentile) resting solely on absence-of-execution reasoning; worth a human check despite minimal class usage (7/1501)." + "value": "High severity xalan CVE with very high EPSS (0.81, 99.6 pct); duration-only justification is weak evidence for this exploitability profile despite minimal class usage (7 of 1501)." } ] }, @@ -20697,11 +20756,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable duration-based claim." + "value": "High severity spring-core CVE, duration-only justification." } ] }, @@ -20807,11 +20866,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.09); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -20917,11 +20976,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but negligible EPSS; acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -21027,11 +21086,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -21141,7 +21200,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -21251,7 +21310,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity despite elevated EPSS (0.35); lower stakes make acceptance reasonable." + "value": "Medium severity, duration-only acceptance is low-stakes despite EPSS 0.35." } ] }, @@ -21361,7 +21420,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -21471,7 +21530,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -21577,11 +21636,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but negligible EPSS; acceptable duration-based claim." + "value": "High severity spring-expression CVE, duration-only justification." } ] }, @@ -21687,11 +21746,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but negligible EPSS; acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -21797,11 +21856,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but negligible EPSS; acceptable duration-based claim." + "value": "High severity, duration-only justification." } ] }, @@ -21911,7 +21970,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -22021,7 +22080,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -22131,7 +22190,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity despite elevated EPSS (0.36); lower stakes make acceptance reasonable." + "value": "Medium severity, duration-only acceptance is low-stakes despite EPSS 0.36." } ] }, @@ -22241,7 +22300,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -22351,7 +22410,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -22457,11 +22516,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, very low EPSS (0.01); acceptable duration-based claim." + "value": "High severity spring-boot-autoconfigure CVE, duration-only justification." } ] }, @@ -22571,7 +22630,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -22677,11 +22736,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, low EPSS (0.03); acceptable duration-based claim despite heavy class usage (1563/3787)." + "value": "High severity hibernate-core CVE, duration-only justification with substantial library usage (1563 of 3787 classes)." } ] }, @@ -22791,7 +22850,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -22897,11 +22956,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but negligible EPSS (0.0); acceptable duration-based claim." + "value": "High severity hibernate-validator CVE, duration-only justification." } ] }, @@ -23007,11 +23066,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but negligible EPSS (0.0); acceptable duration-based claim." + "value": "High severity guava CVE, duration-only justification." } ] }, @@ -23121,7 +23180,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; acceptable duration-based claim." + "value": "Low severity, duration-only acceptance is low-stakes." } ] }, @@ -23229,7 +23288,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity score; low stakes duration-based claim." + "value": "Severity unrated (0.0); duration-only acceptance is low-stakes despite EPSS 0.17." } ] }, @@ -23337,7 +23396,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity score; low stakes duration-based claim." + "value": "Severity unrated (0.0); duration-only acceptance is low-stakes despite EPSS 0.25." } ] }, @@ -23447,7 +23506,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -23557,7 +23616,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -23667,7 +23726,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -23775,7 +23834,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 0 classes; structurally sound." + "value": "code_not_reachable, 0 of 0 classes loaded - structural fact." } ] }, @@ -23883,7 +23942,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -23991,7 +24050,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -24099,7 +24158,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds despite elevated EPSS (0.16)." } ] }, @@ -24207,7 +24266,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -24315,7 +24374,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -24423,7 +24482,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 286 classes loaded; structurally sound." + "value": "code_not_reachable, 0 of 286 classes loaded - structural fact." } ] }, @@ -24531,7 +24590,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 152 classes loaded (commons-lang3); structurally sound." + "value": "commons-lang3: code_not_reachable, 0 of 152 classes loaded - structural fact." } ] }, @@ -24639,7 +24698,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 152 classes loaded (commons-lang3); structurally sound." + "value": "commons-lang3: code_not_reachable, 0 of 152 classes loaded - structural fact." } ] }, @@ -24749,7 +24808,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -24859,7 +24918,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -24969,7 +25028,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS (0.06); acceptable duration-based claim." + "value": "Medium severity, duration-only acceptance is low-stakes." } ] }, @@ -25079,7 +25138,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity (spring-context); acceptable duration-based claim." + "value": "spring-context: medium severity, duration-only acceptance is low-stakes." } ] }, @@ -25189,7 +25248,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; acceptable duration-based claim." + "value": "Low severity, duration-only acceptance is low-stakes." } ] }, @@ -25297,7 +25356,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 466 classes loaded; structurally sound." + "value": "code_not_reachable, 0 of 466 classes loaded - structural fact." } ] }, @@ -25405,7 +25464,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 110 classes loaded; structurally sound." + "value": "code_not_reachable, 0 of 110 classes loaded - structural fact." } ] }, @@ -25513,7 +25572,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structurally sound." + "value": "code_not_reachable; structural non-reachability holds." } ] }, @@ -25623,7 +25682,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS; acceptable duration-based claim." + "value": "Medium severity (4.0), duration-only acceptance is low-stakes." } ] }, @@ -25731,7 +25790,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity score; low stakes duration-based claim." + "value": "Severity unrated; duration-only acceptance is low-stakes." } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index 651f954..bb620fa 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -38,7 +38,15 @@ public class VEXAdvisor { "vulnerable code path hasn't executed in N days of observation). Your job is NOT to re-derive the CVE - it " + "is to judge whether relying on each claim, as stated, is reasonable given the CVE's severity/exploitability, " + "or whether it's the kind of claim a human reviewer should double-check before trusting it.\n\n" + + "You're also given whether Assess (the module that produces the runtime evidence every claim rests on) and " + + "Protect (the classic HTTP-rule-based RASP module, distinct from CVE Shield) are enabled per environment " + + "for this application. Weigh this directly: a duration-based claim scoped to an environment where Assess " + + "itself has no data or is disabled isn't weak evidence, it's NO evidence - flag it regardless of severity. " + + "A claim in an environment where Protect is disabled has one less active mitigating control as a backstop " + + "if the absence-of-execution reasoning turns out wrong, which raises the stakes of getting it wrong.\n\n" + "## What makes a claim worth flagging for review\n\n" + + "- Any duration-based claim scoped to an environment where Assess has no data or is disabled - there is no " + + "runtime evidence behind it at all, regardless of the CVE's severity.\n" + "- A `not_affected` claim justified only by \"N days without observed execution\" (not by code_not_reachable " + "or protected_at_runtime) on a CRITICAL/HIGH severity CVE, especially one with a high EPSS score or KEV " + "(known-exploited) status - absence of evidence is weaker evidence the more severe/exploitable the CVE is.\n" + @@ -93,6 +101,9 @@ static class VexStatement { static class AppEntry { String name; List statements = new ArrayList<>(); + // "true"/"false"/"" (no agent ever seen in that environment) - see VEXGenerator.ProtectionStatus + String assessEnabledDev, assessEnabledQa, assessEnabledProd; + String protectEnabledDev, protectEnabledQa, protectEnabledProd; } private final Gson gson = new GsonBuilder().setPrettyPrinting().create(); @@ -249,6 +260,22 @@ private List parseVex(String path) throws IOException { }).statements.add(s); } + JsonArray components = vex.has("components") ? vex.getAsJsonArray("components") : new JsonArray(); + for (JsonElement el : components) { + JsonObject c = el.getAsJsonObject(); + if (!"application".equals(getString(c, "type", null))) continue; + String appName = getString(c, "name", null); + AppEntry entry = appName != null ? byApp.get(appName) : null; + if (entry == null) continue; + Map props = properties(c); + entry.assessEnabledDev = props.get("contrast:assessEnabledDev"); + entry.assessEnabledQa = props.get("contrast:assessEnabledQa"); + entry.assessEnabledProd = props.get("contrast:assessEnabledProd"); + entry.protectEnabledDev = props.get("contrast:protectEnabledDev"); + entry.protectEnabledQa = props.get("contrast:protectEnabledQa"); + entry.protectEnabledProd = props.get("contrast:protectEnabledProd"); + } + return new ArrayList<>(byApp.values()); } @@ -261,6 +288,16 @@ private long parseLong(String s) { } } + /** "" (no agent ever seen) is distinct from "false" (agent seen, module explicitly disabled). */ + private String formatEnvFlags(String dev, String qa, String prod) { + return "dev=" + envFlagLabel(dev) + ", qa=" + envFlagLabel(qa) + ", prod=" + envFlagLabel(prod); + } + + private String envFlagLabel(String value) { + if (value == null || value.isEmpty()) return "no data"; + return "true".equals(value) ? "enabled" : "disabled"; + } + private Double parseDouble(String s) { if (s == null || s.isEmpty()) return null; try { @@ -290,6 +327,10 @@ private String getString(JsonObject obj, String key, String def) { private String formatAppForAi(AppEntry entry) { StringBuilder sb = new StringBuilder(); sb.append("Application: ").append(entry.name).append("\n\n"); + sb.append("Assess (the module that produces the runtime evidence behind every claim below) enabled: ") + .append(formatEnvFlags(entry.assessEnabledDev, entry.assessEnabledQa, entry.assessEnabledProd)).append("\n"); + sb.append("Protect enabled (classic RASP module, not CVE Shield - no separate enablement flag for that is available): ") + .append(formatEnvFlags(entry.protectEnabledDev, entry.protectEnabledQa, entry.protectEnabledProd)).append("\n\n"); sb.append("VEX Claims:"); for (VexStatement s : entry.statements) { @@ -517,7 +558,12 @@ private String generateReport(List appResults, List entrie sb.append("| `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold |\n"); sb.append("| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold |\n\n"); sb.append("Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth ") - .append("a second look surface at the top - see the Key Findings above for which specific CVEs those are.\n"); + .append("a second look surface at the top - see the Key Findings above for which specific CVEs those are.\n\n"); + sb.append("**Protection Status** (shown per app below) - Assess is the module that produces the runtime ") + .append("evidence every claim in this report rests on; Protect is the classic HTTP-rule-based RASP module. ") + .append("Neither is CVE Shield - CVE Shield is a separate, newer product that defends specific CVEs via a ") + .append("microsandbox rather than HTTP rules, and Contrast's API exposes no distinct enablement flag for it. ") + .append("CVE Shield's own per-CVE verdicts still show up per-claim above as the `CVE Shielded` rationale.\n"); sb.append("\n---\n\n## Application Detail\n\n"); @@ -534,6 +580,13 @@ private String generateReport(List appResults, List entrie String riskLevel = getString(r, "risk_level", "UNKNOWN"); sb.append("### ").append(appName).append("\n\n**Risk Level:** ").append(riskLevel).append("\n\n"); + if (entry != null) { + sb.append("**Protection Status:** Assess (runtime evidence): ") + .append(formatEnvFlags(entry.assessEnabledDev, entry.assessEnabledQa, entry.assessEnabledProd)) + .append(" · Protect (classic RASP, not CVE Shield): ") + .append(formatEnvFlags(entry.protectEnabledDev, entry.protectEnabledQa, entry.protectEnabledProd)) + .append("\n\n"); + } sb.append(getString(r, "application_description", "No description available.")).append("\n\n"); sb.append("**Risk Rationale:** ").append(getString(r, "risk_rationale", "Unknown")).append("\n\n"); sb.append("**Recommendation:** ").append(getString(r, "recommendation", "None")).append("\n\n"); diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java index 0556983..17c43cc 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java @@ -50,10 +50,11 @@ * CVE Shield/Protect observation data to justify "not affected"/"in triage" claims * rather than fabricating them. * - * Three data sources, all under the same contrast.properties credentials: + * Four data sources, all under the same contrast.properties credentials: * - GET /api/v4/organizations/{org}/applications app first/last seen * - POST /Contrast/api/ng/{org}/libraries/filter per-library CVEs + runtime class-usage * - GET /api/ns-ui/v1/organizations/{org}/applications/{id}/cves/issues per-CVE per-environment Shield/Protect status + * - GET /Contrast/api/ng/{org}/applications/{id}/servers per-server Assess/Protect module enablement * * Decision rules (see CLAUDE.md discussion - these are policy, not spec): * 1. classes_used == 0 for the app+library -> not_affected / code_not_reachable, unconditional. @@ -65,6 +66,14 @@ * day count and threshold as an operational risk-acceptance, not a structural guarantee. * - days observed < acceptAfterDays -> in_triage, detail explains the day count so far. * + * Not factored into the decision rules above (deliberately - see ProtectionStatus): whether Assess/Protect are + * even enabled per environment. A "not seen" claim scoped to an environment where Assess itself isn't running + * has no runtime evidence behind it at all, but rather than silently changing the claim, that fact is reported + * as its own contrast:assessEnabled and contrast:protectEnabled property (per env) so a human (or the VEX + * Advisor) can weigh it. Note "Protect" here is the classic HTTP-rule-based RASP module (the API's `defend` + * flag) - CVE Shield is a separate, newer microsandbox-based product with no distinct enablement flag found + * in this API; see ProtectionStatus below for what that means for this report. + * * Usage: * java -jar runtime-analyst.jar vex --app "MyApp" * java -jar runtime-analyst.jar vex --list @@ -327,6 +336,64 @@ private Map fetchCveIssues(String appId) throws IOException { return issues; } + // ---- Assess/Protect module enablement, per app ---- + + /** + * `defend` is the classic Protect module (HTTP-rule-based RASP) - a different, older product from CVE + * Shield (which defends specific CVEs via a microsandbox, not HTTP rules). This API exposes no separate + * enablement flag for CVE Shield or for "ADR" as a distinct product, so this only reports Protect/Assess + * enablement; it does NOT claim to say whether CVE Shield itself is available or enabled. CVE Shield's own + * per-CVE verdicts (PROTECTING/BLOCKED/etc, from cves/issues) still show up per-claim regardless - see the + * `protected_at_runtime` justification and the devStatus/qaStatus/prodStatus properties below. + */ + private static class ProtectionStatus { + Boolean assessEnabledDev, assessEnabledQa, assessEnabledProd; + Boolean protectEnabledDev, protectEnabledQa, protectEnabledProd; + } + + private ProtectionStatus fetchProtectionStatus(String appId) throws IOException { + String url = host + "/Contrast/api/ng/" + orgId + "/applications/" + appId + "/servers"; + HttpGet get = new HttpGet(url); + get.setHeader("Authorization", authHeader); + get.setHeader("API-Key", apiKey); + get.setHeader("Accept", "application/json"); + + HttpResponse response = httpClient.execute(get); + int statusCode = response.getStatusLine().getStatusCode(); + String body = EntityUtils.toString(response.getEntity()); + if (statusCode != 200) { + throw new IOException("Servers API returned status " + statusCode + ": " + body); + } + + ProtectionStatus ps = new ProtectionStatus(); + JsonObject json = gson.fromJson(body, JsonObject.class); + if (!json.has("servers")) { + return ps; + } + for (JsonElement el : json.getAsJsonArray("servers")) { + JsonObject server = el.getAsJsonObject(); + String env = getStringOrNull(server, "environment"); + boolean assess = server.has("assess") && !server.get("assess").isJsonNull() && server.get("assess").getAsBoolean(); + boolean protect = server.has("defend") && !server.get("defend").isJsonNull() && server.get("defend").getAsBoolean(); + if ("DEVELOPMENT".equals(env)) { + ps.assessEnabledDev = orTrue(ps.assessEnabledDev, assess); + ps.protectEnabledDev = orTrue(ps.protectEnabledDev, protect); + } else if ("QA".equals(env)) { + ps.assessEnabledQa = orTrue(ps.assessEnabledQa, assess); + ps.protectEnabledQa = orTrue(ps.protectEnabledQa, protect); + } else if ("PRODUCTION".equals(env)) { + ps.assessEnabledProd = orTrue(ps.assessEnabledProd, assess); + ps.protectEnabledProd = orTrue(ps.protectEnabledProd, protect); + } + } + return ps; + } + + /** Null (no server seen yet) stays null only if never set; otherwise ORs across multiple servers in the same env. */ + private Boolean orTrue(Boolean existing, boolean value) { + return existing == null ? value : (existing || value); + } + // ---- Libraries: CVEs + runtime class usage, per app ---- private JsonArray fetchLibraries(String appId) throws IOException { @@ -389,13 +456,16 @@ private JsonArray fetchLibraries(String appId) throws IOException { public Bom generateVEX(List apps) throws IOException { Bom bom = new Bom(); List vulnerabilities = new ArrayList<>(); + List appComponents = new ArrayList<>(); for (AppInfo app : apps) { System.out.println("\nProcessing " + app.name + " (" + app.id + ")..."); Map cveIssues = fetchCveIssues(app.id); JsonArray libraries = fetchLibraries(app.id); + ProtectionStatus protection = fetchProtectionStatus(app.id); System.out.println(" " + libraries.size() + " vulnerable libraries, " + cveIssues.size() + " CVE issue records"); + appComponents.add(buildAppComponent(app, protection)); long daysObserved = (app.lastSeenTime > app.firstSeenTime) ? (app.lastSeenTime - app.firstSeenTime) / (1000L * 60 * 60 * 24) @@ -438,20 +508,40 @@ public Bom generateVEX(List apps) throws IOException { System.out.println("\nGenerated " + vulnerabilities.size() + " VEX statements."); bom.setVulnerabilities(vulnerabilities); + bom.setComponents(appComponents); if (apps.size() == 1) { - Component appComponent = new Component(); - appComponent.setType(Component.Type.APPLICATION); - appComponent.setName(apps.get(0).name); - appComponent.setBomRef(sanitizeBomRef(apps.get(0).id)); Metadata metadata = new Metadata(); - metadata.setComponent(appComponent); + metadata.setComponent(appComponents.get(0)); bom.setMetadata(metadata); } return bom; } + /** Carries Assess/Protect module-enablement facts (see ProtectionStatus) - one per app, not repeated per statement. */ + private Component buildAppComponent(AppInfo app, ProtectionStatus protection) { + Component appComponent = new Component(); + appComponent.setType(Component.Type.APPLICATION); + appComponent.setName(app.name); + appComponent.setBomRef(sanitizeBomRef(app.id)); + + List properties = new ArrayList<>(); + properties.add(property("contrast:assessEnabledDev", enabledLabel(protection.assessEnabledDev))); + properties.add(property("contrast:assessEnabledQa", enabledLabel(protection.assessEnabledQa))); + properties.add(property("contrast:assessEnabledProd", enabledLabel(protection.assessEnabledProd))); + properties.add(property("contrast:protectEnabledDev", enabledLabel(protection.protectEnabledDev))); + properties.add(property("contrast:protectEnabledQa", enabledLabel(protection.protectEnabledQa))); + properties.add(property("contrast:protectEnabledProd", enabledLabel(protection.protectEnabledProd))); + appComponent.setProperties(properties); + return appComponent; + } + + /** "" (no data) means no agent was ever seen reporting from that environment - not the same as "disabled". */ + private String enabledLabel(Boolean value) { + return value == null ? "" : String.valueOf(value); + } + /** Returns null when the CVE shouldn't get a VEX statement at all (exposed/exploited/unrecognized status). */ private Vulnerability buildVulnerability(AppInfo app, String group, String fileName, String fileVersion, String hash, long classesUsed, long classCount, String cveId, JsonObject vuln, From 651ea7d96ca892e93fc0a6c4f382fa7c7efeb179 Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 22:47:10 -0400 Subject: [PATCH 12/16] Rename Protect->ADR, detect real CVE Shield availability, fix a dropped-CVE bug Rebrand: "Protect" is now "ADR" per product naming. Renamed contrast:protectEnabled* -> contrast:adrEnabled*, ProtectionStatus -> ModuleStatus, and all display text/prompts accordingly. CVE Shield availability: added GET /organizations/{org}/cves (org-wide, paginated) for cveShieldExists per CVE. More importantly, scanning every application in this org's cves/issues data turned up a real, previously-unhandled per-environment status value: NO_SHIELD, distinct from NOT_SEEN. NO_SHIELD means CVE Shield has no coverage for that CVE in that environment at all - "we haven't seen it" means nothing when nothing was capable of catching it. NOT_SEEN means Shield exists there and simply hasn't fired - a materially different, stronger claim. This was a real bug, not just a missing feature: NOT_SEEN_STATUSES only matched "NOT_SEEN", so a CVE with NO_SHIELD in every considered environment fell through to the final "never suppress" branch and got DROPPED from the VEX entirely - no statement, no explanation, silently missing. For SAML-PetClinic-Demo this recovered 16 previously-invisible CVEs (235 -> 251 statements). Fixed by adding NO_SHIELD to NOT_SEEN_STATUSES (same duration-based logic applies) while tracking it separately via a new shieldAvailability() helper, preferring the per-app/per-env signal over the org-wide cveShieldExists fallback. Surfaced as contrast:shieldAvailable ("true"/"false", per statement) and a new **Shield** column (Yes/No/-) in the VEX Advisor's compressed table - your explicit ask: "if shield is available, report the ability to enable it." Fed into the AI prompt and Legend too, and the detail text for CVE Not Used claims now says so when Shield has zero coverage. Also simplified remaining "CVE Shield/Protect" phrasing (pre-existing, describing the per-CVE protected_at_runtime justification) to just "CVE Shield", now that NO_SHIELD/protectingCount/blockedCount confirm that data is CVE Shield's own domain, not the general ADR/RASP module. Regenerated samples/sample-vex.json and sample-vex-advisor.md against SAML-PetClinic-Demo; re-validated against the CycloneDX 1.6 schema. --- README.md | 22 +- samples/sample-vex-advisor.md | 530 +- samples/sample-vex.json | 6354 ++++++++++++----- .../runtimeanalyst/VEXAdvisor.java | 72 +- .../runtimeanalyst/VEXGenerator.java | 166 +- 5 files changed, 5023 insertions(+), 2121 deletions(-) diff --git a/README.md b/README.md index b422831..cc0fe76 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ Runtime Analyst turns Contrast Security's runtime observability data into struct - **AI** - every AI model and provider observed running, with cloud-vs-local classification for shadow-AI visibility. Produces a AIBOM and an AI-powered analysis report - **Blueprint (alpha)** - a map of how your apps/APIs connect and behave: assets, deployment zones, connections, and crypto/AI behaviors - **Threat Model** (coming soon) - TBD -- **Vulnerability Exclusion** - an analysis of library CVE exposure in your apps/APIs, based Contrast's runtime library-usage and CVE Shield/Protect data. Produces a VEX document and an AI-powered analysis report. +- **Vulnerability Exclusion** - an analysis of library CVE exposure in your apps/APIs, based Contrast's runtime library-usage and CVE Shield data. Produces a VEX document and an AI-powered analysis report. **Requirements:** @@ -136,12 +136,12 @@ By default a claim considers the application's dev/qa/prod environments together 1. **Library never loaded at runtime in this application** (`classes_used == 0` for that app) → `not_affected` -2. **Library loaded, but CVE Shield/Protect is actively mitigating it for this application** +2. **Library loaded, but CVE Shield is actively mitigating it for this application** → `not_affected` / `protected_at_runtime`. 3. **Library loaded, and this application's CVE status is `EXPOSED`/`EXPLOITED`** → no VEX statement at all. This tool never suppresses a vulnerability it can't positively account for. -4. **Library loaded, but the CVE has never been observed executing in this application** - → a statement is still generated, with the actual number of days recorded as the reason. +4. **Library loaded, but the CVE has never been observed executing in this application** (whether because CVE Shield exists and simply hasn't fired, or because CVE Shield has no coverage for that CVE at all - `NO_SHIELD`, a real per-environment status distinct from `NOT_SEEN`, confirmed by scanning every application in the org) + → a statement is still generated, with the actual number of days recorded as the reason, and which case it was recorded separately (`contrast:shieldAvailable`) - earlier versions of this tool silently dropped `NO_SHIELD`-only CVEs instead of generating a claim for them, which was a bug, not a policy choice. Every statement carries `contrast:*` properties (`classesUsed`/`classCount`, `daysObserved`, `acceptAfterDays`, `envFilter`, and the per-environment `devStatus`/`qaStatus`/`prodStatus`) so a reviewer can see the underlying evidence, not just the resulting state. @@ -203,12 +203,14 @@ A standard CycloneDX 1.6 document with a top-level `vulnerabilities[]` array, on - `affects[].versions[]` - the deployed version (`affected`) and, when Contrast has upgrade guidance for the library, the recommended fixed version (`unaffected`) - `recommendation` - the remediation action: Contrast's own minimal-upgrade guidance for the library when available, falling back to "no newer release identified" when it isn't - `analysis.state`/`analysis.justification`/`analysis.detail` - the VEX claim itself and why it was made (see the policy in the [`vex` examples](#vex) above) -- `analysis.response[]` - `update` when a fix version is known, `workaround_available` for `protected_at_runtime` claims (the active Shield/Protect control **is** the workaround), omitted otherwise -- `properties[]` - the underlying evidence (`contrast:classesUsed`/`classCount`, `contrast:daysObserved`, `contrast:acceptAfterDays`, `contrast:devStatus`/`qaStatus`/`prodStatus`, `contrast:latestVersion`) plus exploitability signals (`contrast:epssScore`/`epssPercentile`, `contrast:cisaKev` - CISA Known Exploited Vulnerabilities catalog membership) +- `analysis.response[]` - `update` when a fix version is known, `workaround_available` for `protected_at_runtime` claims (the active CVE Shield control **is** the workaround), omitted otherwise +- `properties[]` - the underlying evidence (`contrast:classesUsed`/`classCount`, `contrast:daysObserved`, `contrast:acceptAfterDays`, `contrast:devStatus`/`qaStatus`/`prodStatus`, `contrast:latestVersion`) plus exploitability signals (`contrast:epssScore`/`epssPercentile`, `contrast:cisaKev` - CISA Known Exploited Vulnerabilities catalog membership) plus `contrast:shieldAvailable` - whether CVE Shield could catch this specific CVE at all in the environment(s) considered (`"true"`/`"false"`/absent if unknown) -All of the above is deterministic, pulled directly from Contrast's own CVE/library data - nothing here is AI-generated, since a VEX claim is an attestation and needs to stay auditable back to its source evidence. The EPSS/CISA KEV signals are new inputs to the **VEX Advisor**'s AI judgment (below), not to the claim itself. +All of the above is deterministic, pulled directly from Contrast's own CVE/library data - nothing here is AI-generated, since a VEX claim is an attestation and needs to stay auditable back to its source evidence. The EPSS/CISA KEV/Shield-availability signals are new inputs to the **VEX Advisor**'s AI judgment (below), not to the claim itself. -The document also has a top-level `components[]` array with one Application component per app, carrying whether Assess (the module that produces every claim's runtime evidence) and Protect (the classic HTTP-rule-based RASP module) are enabled per environment: `contrast:assessEnabledDev`/`Qa`/`Prod` and `contrast:protectEnabledDev`/`Qa`/`Prod` (`"true"`/`"false"`/`""` - empty means no agent was ever seen reporting from that environment, which is a different fact from "disabled"). This is *not* CVE Shield - Contrast's API exposes no separate enablement flag for CVE Shield, a newer product that defends specific CVEs via a microsandbox rather than HTTP rules, so this tool doesn't claim to report on it. CVE Shield's own per-CVE verdicts still show up per-claim as the `protected_at_runtime` justification (from the same `PROTECTING`/`BLOCKED` statuses the `devStatus`/`qaStatus`/`prodStatus` properties already carry) - this new data adds the missing "was anything even watching" context around those claims, not a duplicate of them. +`contrast:shieldAvailable` prefers a real, app-scoped signal: Contrast's per-application `cves/issues` endpoint returns a `NO_SHIELD` status (distinct from `NOT_SEEN`, confirmed by scanning every application in this org) meaning CVE Shield has no coverage for that CVE in that environment at all - a materially weaker basis for `not_affected` than `NOT_SEEN` (Shield exists there and simply hasn't fired). When there's no per-app signal either way, it falls back to the org-wide `cveShieldExists` flag from `/organizations/{org}/cves`. Earlier versions of this tool silently *dropped* `NO_SHIELD`-only CVEs from the VEX entirely instead of generating a claim for them - a real bug, since the "never suppress" policy above is meant to apply to `EXPOSED`/`EXPLOITED` CVEs, not ones where CVE Shield just doesn't cover them. + +The document also has a top-level `components[]` array with one Application component per app, carrying whether Assess (the module that produces every claim's runtime evidence) and ADR (the classic HTTP-rule-based RASP module, formerly branded "Protect" - a different, older product from CVE Shield) are enabled per environment: `contrast:assessEnabledDev`/`Qa`/`Prod` and `contrast:adrEnabledDev`/`Qa`/`Prod` (`"true"`/`"false"`/`""` - empty means no agent was ever seen reporting from that environment, which is a different fact from "disabled"). ``` Contrast VEX @@ -217,13 +219,13 @@ Contrast VEX └── CVE-2022-22965 (spring-webmvc 4.3.9) → not_affected (288 days, no observed execution) ``` -Note: `PROTECTED_AT_RUNTIME` (CVE Shield/Protect actively mitigating) is implemented but not yet confirmed against a live example with that status - see the caveats in the `vex` command's own help/design notes before relying on it. +Note: `PROTECTED_AT_RUNTIME` (CVE Shield actively mitigating) is implemented but not yet confirmed against a live example with that status - see the caveats in the `vex` command's own help/design notes before relying on it. ### Advisor reports - **Quantum Advisor** - findings grouped by risk level (CRITICAL/HIGH/MEDIUM/LOW/NOT_QUANTUM_ISSUE), with an "Application Context" section describing each app from its architecture graph data - **AI Advisor** - organized as an inventory of AI-enabled applications (one section per app, not per finding): an AI-generated description of what the app does, then each AI usage instance with model/provider/endpoint and a description of what that specific call is doing, inferred from the key methods around it in the stack trace -- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Rationale`, e.g. `CVE Not Used 288d` or `Library Unused` - decoded in a legend) instead of a full-sentence rationale repeated per claim. Rows sort CISA KEV-listed first, then by EPSS, then by CVSS score, so the claims worth a second look surface at the top without needing a separate flag column - there's no distinct action per severity tier (the real options, verify reachability or upgrade, are the same regardless), so the report doesn't pretend otherwise with a column that can't back it up. Each app's section also shows a **Protection Status** line (Assess/Protect enablement per environment, from the VEX's own `components[]` - see above) and feeds it to the AI: a duration-based claim in an environment where Assess has no data isn't weak evidence, it's *no* evidence, regardless of the CVE's severity. +- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Shield | Rationale`, e.g. `Yes` / `CVE Not Used 288d` or `No` / `CVE Not Used 288d` - decoded in a legend) instead of a full-sentence rationale repeated per claim. The **Shield** column is `contrast:shieldAvailable` - `No` means the claim rests entirely on absence-of-execution with no possible active backstop, which is materially weaker than the same claim where Shield exists and simply hasn't fired. Rows sort CISA KEV-listed first, then by EPSS, then by CVSS score, so the claims worth a second look surface at the top without needing a separate flag column - there's no distinct action per severity tier (the real options, verify reachability or upgrade, are the same regardless), so the report doesn't pretend otherwise with a column that can't back it up. Each app's section also shows a **Protection Status** line (Assess/ADR enablement per environment, from the VEX's own `components[]` - see above) and feeds all of this to the AI: a duration-based claim in an environment where Assess has no data isn't weak evidence, it's *no* evidence, and a claim where Shield has zero coverage for that CVE is weaker still than one where Shield exists and just hasn't fired. Both the Quantum and AI Advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component. The VEX Advisor writes `contrast:vexAdvisorAssessment` (`sound`/`needs_review`) and `contrast:vexAdvisorRationale` back onto each vulnerability's `properties[]`. All of this happens automatically as part of every `--analyze` run, no separate step needed. diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index 6cbfa10..4c39b28 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -12,43 +12,45 @@ ## Summary -This report reviews VEX (Vulnerability Exploitability eXchange) claims generated from Contrast Security runtime library-usage and CVE Shield/Protect data. It does not re-derive whether a CVE exists - it judges whether each `not_affected`/`in_triage` claim is well-supported enough to rely on as-is, or whether a human should look at it first. +This report reviews VEX (Vulnerability Exploitability eXchange) claims generated from Contrast Security runtime library-usage and CVE Shield data. It does not re-derive whether a CVE exists - it judges whether each `not_affected`/`in_triage` claim is well-supported enough to rely on as-is, or whether a human should look at it first. -**Coverage:** 1 application(s), 235 VEX statement(s) reviewed. +**Coverage:** 1 application(s), 251 VEX statement(s) reviewed. **Key Findings:** -- **125 of 235 claim(s) flagged for human review** before relying on them. +- **25 of 251 claim(s) flagged for human review** before relying on them. - **8 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. -- **10 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+4 more). +- **11 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+5 more). - Application(s) rated CRITICAL/HIGH risk: SAML-PetClinic-Demo. ### Applications | Application | Risk Level | Statements | |-------------|------------|------------| -| SAML-PetClinic-Demo | CRITICAL | 235 | +| SAML-PetClinic-Demo | HIGH | 251 | | Risk Level | Applications | |------------|--------------| -| CRITICAL | 1 | +| HIGH | 1 | ### Legend **VEX** - `NA` = not_affected, `IT` = in_triage +**Shield** - whether CVE Shield could catch this specific CVE at all in the environment(s) considered: `Yes` (Shield exists there, even if it hasn't fired), `No` (no Shield coverage for this CVE at all - the claim rests entirely on absence-of-execution, with no possible active backstop), `-` (no signal either way). + **Rationale** - why the claim was made, with the day count for the two duration-based reasons: | Rationale | Meaning | |-----------|---------| | `Library Unused` | Library never loaded at runtime (0 classes) - structural, not time-based | -| `CVE Shielded` | CVE Shield/Protect actively mitigating at runtime - an active control, not time-based | +| `CVE Shielded` | CVE Shield actively mitigating at runtime - an active control, not time-based | | `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold | | `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold | Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth a second look surface at the top - see the Key Findings above for which specific CVEs those are. -**Protection Status** (shown per app below) - Assess is the module that produces the runtime evidence every claim in this report rests on; Protect is the classic HTTP-rule-based RASP module. Neither is CVE Shield - CVE Shield is a separate, newer product that defends specific CVEs via a microsandbox rather than HTTP rules, and Contrast's API exposes no distinct enablement flag for it. CVE Shield's own per-CVE verdicts still show up per-claim above as the `CVE Shielded` rationale. +**Protection Status** (shown per app below) - Assess is the module that produces the runtime evidence every claim in this report rests on; ADR (formerly branded "Protect") is the classic HTTP-rule-based RASP module. Neither is CVE Shield - CVE Shield is a separate product that defends specific CVEs via a microsandbox rather than HTTP rules. Its own coverage is the per-row **Shield** column above, sourced from the real per-app, per-environment NO_SHIELD/NOT_SEEN signal where available. --- @@ -56,259 +58,275 @@ Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, s ### SAML-PetClinic-Demo -**Risk Level:** CRITICAL - -**Protection Status:** Assess (runtime evidence): dev=enabled, qa=no data, prod=enabled · Protect (classic RASP, not CVE Shield): dev=disabled, qa=no data, prod=enabled - -SAML-PetClinic-Demo has roughly 240 VEX claims across ~30 libraries, generated from 288 days of Contrast runtime observation (Assess enabled in dev/prod, no data in qa; Protect/RASP enabled in prod but disabled in dev). About 90 claims rest on genuine structural evidence (code_not_reachable, 0 classes ever loaded) and are safe to trust as-is. The remaining ~150 claims, including several CRITICAL/KEV CVEs (Spring4Shell CVE-2022-22965 across three libraries, GhostCat CVE-2020-1938, Tomcat CVE-2025-24813/2017-12617/2023-44487, and spring-data-commons CVE-2018-1273 with EPSS 0.97), are 'not_affected' purely because the vulnerable path hasn't fired in 288 days - a probabilistic absence-of-evidence argument, not a structural guarantee. - -**Risk Rationale:** Multiple KEV-listed, actively-exploited CVEs (CVE-2022-22965 Spring4Shell on spring-boot-starter-web/spring-webmvc/spring-beans, CVE-2020-1938 GhostCat, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487, and CVE-2018-1273 with EPSS 0.97) are all being waived on duration-only reasoning rather than code_not_reachable or protected_at_runtime. Given that Protect (RASP) is disabled in dev, there is no active backstop control there if any of this reasoning is wrong, and dozens of other CRITICAL/HIGH jackson-databind and tomcat-embed-core CVEs share the same weak justification pattern at scale. None of the Assess/Protect enablement data by itself invalidates the evidence (dev and prod both have Assess data), but the sheer number of severe, duration-only claims - several tied to CVEs with public exploits in the KEV catalog - makes this VEX set unsafe to rely on without human review of the highest-severity items. - -**Recommendation:** Prioritize human review of every KEV-listed or EPSS>0.3 CVE relying on duration-only justification, especially CVE-2022-22965 (all three libraries), CVE-2020-1938, CVE-2025-24813, CVE-2017-12617, CVE-2023-44487, and CVE-2018-1273. For these, either confirm code-level unreachability manually, add compensating controls (e.g., enable Protect in dev), or escalate to patch given the low cost/high benefit of upgrading jackson-databind, tomcat-embed-core, and the Spring stack. The code_not_reachable claims (htmlunit, snakeyaml, netty, jetty-http, plexus-utils, commons-compress, bootstrap, junit, commons-lang/commons-lang3, commons-io, httpclient, neko-htmlunit) can be trusted as-is. Medium/low/unknown-severity duration-based claims are acceptable without further action. - -| CVE | Library | Score | VEX | Rationale | -|-----|---------|-------|-----|-----------| -| CVE-2022-22965 | spring-boot-starter-web@1.5.4.RELEASE | 9.8 | NA | Library Unused | -| CVE-2022-22965 | spring-webmvc@4.3.9.RELEASE | 9.8 | NA | CVE Not Used 288d | -| CVE-2022-22965 | spring-beans@4.3.9.RELEASE | 9.8 | NA | CVE Not Used 288d | -| CVE-2025-24813 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | -| CVE-2017-12617 | tomcat-embed-core@8.5.15 | 8.1 | NA | CVE Not Used 288d | -| CVE-2023-44487 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2020-1938 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | -| CVE-2018-1273 | spring-data-commons@1.13.4.RELEASE | 9.8 | NA | CVE Not Used 288d | -| CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Library Unused | -| CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | CVE Not Used 288d | -| CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | CVE Not Used 288d | -| CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | CVE Not Used 288d | -| CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2025-55752 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2025-31650 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2025-48988 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2020-9484 | tomcat-embed-core@8.5.15 | 7.0 | NA | CVE Not Used 288d | -| CVE-2024-38819 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2017-17485 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2019-0221 | tomcat-embed-core@8.5.15 | 6.1 | NA | CVE Not Used 288d | -| CVE-2019-12384 | jackson-databind@2.8.8 | 5.9 | NA | CVE Not Used 288d | -| CVE-2024-50379 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | -| CVE-2017-7525 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2022-22950 | spring-expression@4.3.9.RELEASE | 6.5 | NA | CVE Not Used 288d | -| CVE-2018-1271 | spring-core@4.3.9.RELEASE | 5.9 | NA | CVE Not Used 288d | -| CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | CVE Not Used 288d | -| CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Library Unused | -| CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | CVE Not Used 288d | -| CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | CVE Not Used 288d | -| CVE-2018-8014 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | -| CVE-2019-12086 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | -| CVE-2020-36179 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2018-8034 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2018-1336 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2018-7489 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2021-21295 | netty@3.5.7.Final | 5.9 | NA | Library Unused | -| CVE-2020-9548 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2020-9547 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2020-25649 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | -| CVE-2021-25122 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2018-1304 | tomcat-embed-core@8.5.15 | 5.9 | NA | CVE Not Used 288d | -| CVE-2012-0881 | xercesimpl@2.11.0 | 0.0 | NA | CVE Not Used 288d | -| CVE-2019-8331 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | -| CVE-2018-1305 | tomcat-embed-core@8.5.15 | 6.5 | NA | CVE Not Used 288d | -| CVE-2024-21733 | tomcat-embed-core@8.5.15 | 5.3 | NA | CVE Not Used 288d | -| CVE-2018-14718 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2019-20445 | netty@3.5.7.Final | 9.1 | NA | Library Unused | -| CVE-2020-35728 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2021-36090 | commons-compress@1.9 | 7.5 | NA | Library Unused | -| CVE-2022-25647 | gson@2.8.0 | 7.5 | NA | CVE Not Used 288d | -| CVE-2021-35516 | commons-compress@1.9 | 7.5 | NA | Library Unused | -| CVE-2021-35515 | commons-compress@1.9 | 7.5 | NA | Library Unused | -| CVE-2022-23437 | xercesimpl@2.11.0 | 6.5 | NA | CVE Not Used 288d | -| CVE-2019-14540 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2018-19361 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2018-19360 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2018-19362 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2020-36188 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2019-14439 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | -| CVE-2019-17563 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2021-35517 | commons-compress@1.9 | 7.5 | NA | Library Unused | -| CVE-2019-12814 | jackson-databind@2.8.8 | 5.9 | NA | CVE Not Used 288d | -| CVE-2018-8037 | tomcat-embed-core@8.5.15 | 5.9 | NA | CVE Not Used 288d | -| CVE-2018-14721 | jackson-databind@2.8.8 | 10.0 | NA | CVE Not Used 288d | -| CVE-2018-14719 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2020-36184 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2021-29425 | commons-io@2.4 | 4.8 | NA | Library Unused | -| CVE-2019-20330 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2019-20444 | netty@3.5.7.Final | 9.1 | NA | Library Unused | -| CVE-2020-35491 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2020-24616 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2018-12023 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | -| CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | CVE Not Used 288d | -| CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Library Unused | -| CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2017-5929 | logback-core@1.1.11 | 9.8 | NA | CVE Not Used 288d | -| CVE-2017-5929 | logback-classic@1.1.11 | 9.8 | NA | CVE Not Used 288d | -| CVE-2020-10673 | jackson-databind@2.8.8 | 8.8 | NA | CVE Not Used 288d | -| CVE-2020-35490 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2019-16869 | netty@3.5.7.Final | 7.5 | NA | Library Unused | -| CVE-2020-10683 | dom4j@1.6.1 | 9.8 | NA | CVE Not Used 288d | -| CVE-2021-20190 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2018-5968 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2020-24750 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2018-12022 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | -| CVE-2018-1000632 | dom4j@1.6.1 | 7.5 | NA | CVE Not Used 288d | -| CVE-2021-37137 | netty@3.5.7.Final | 7.5 | NA | Library Unused | -| CVE-2018-11307 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2019-14892 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Library Unused | -| CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Library Unused | -| CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2019-17267 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2019-17531 | jackson-databind@2.8.8 | 9.8 | NA | CVE Not Used 288d | -| CVE-2020-36182 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2020-36180 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2020-36186 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2020-36181 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2020-36185 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2020-36187 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2020-36189 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2020-36183 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2020-5529 | htmlunit@2.21 | 8.1 | NA | Library Unused | -| CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | -| CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Library Unused | -| CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Library Unused | -| CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | CVE Not Used 288d | -| CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Library Unused | -| CVE-2022-41853 | hsqldb@2.3.5 | 9.8 | NA | CVE Not Used 288d | -| CVE-2025-31651 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | -| CVE-2018-3258 | mysql-connector-java@5.1.42 | 8.8 | NA | CVE Not Used 288d | -| CVE-2024-22243 | spring-web@4.3.9.RELEASE | 8.1 | NA | CVE Not Used 288d | -| CVE-2021-42550 | logback-core@1.1.11 | 6.6 | NA | CVE Not Used 288d | -| CVE-2018-14042 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | -| CVE-2018-14040 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | -| CVE-2016-10735 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | -| CVE-2018-20677 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | -| CVE-2018-20676 | bootstrap@3.3.6 | 6.1 | NA | Library Unused | -| CVE-2023-26119 | htmlunit@2.21 | 9.8 | NA | Library Unused | -| CVE-2020-10650 | jackson-databind@2.8.8 | 8.1 | NA | CVE Not Used 288d | -| CVE-2024-22259 | spring-web@4.3.9.RELEASE | 8.1 | NA | CVE Not Used 288d | -| CVE-2022-42004 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | -| CVE-2022-42003 | jackson-databind@2.8.8 | 7.5 | NA | CVE Not Used 288d | -| CVE-2022-25857 | snakeyaml@1.17 | 7.5 | NA | Library Unused | -| CVE-2023-46589 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2025-49125 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2018-1272 | spring-core@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2018-11040 | spring-core@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2020-25638 | hibernate-core@5.0.4.Final | 7.4 | NA | CVE Not Used 288d | -| CVE-2025-46701 | tomcat-embed-core@8.5.15 | 7.3 | NA | CVE Not Used 288d | -| CVE-2022-38752 | snakeyaml@1.17 | 6.5 | NA | Library Unused | -| CVE-2021-43797 | netty@3.5.7.Final | 6.5 | NA | Library Unused | -| CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | CVE Not Used 288d | -| CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | CVE Not Used 288d | -| CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2025-53506 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2025-52520 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2022-28366 | neko-htmlunit@2.21 | 7.5 | NA | Library Unused | -| CVE-2022-38749 | snakeyaml@1.17 | 6.5 | NA | Library Unused | -| CVE-2022-38751 | snakeyaml@1.17 | 6.5 | NA | Library Unused | -| CVE-2019-14900 | hibernate-core@5.0.4.Final | 6.5 | NA | CVE Not Used 288d | -| CVE-2024-23672 | tomcat-embed-websocket@8.5.15 | 6.3 | NA | CVE Not Used 288d | -| CVE-2021-21290 | netty@3.5.7.Final | 5.5 | NA | Library Unused | -| CVE-2020-15250 | junit@4.12 | 5.5 | NA | Library Unused | -| CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | CVE Not Used 288d | -| CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Library Unused | -| CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Library Unused | -| CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | CVE Not Used 288d | -| CVE-2026-43515 | tomcat-embed-core@8.5.15 | 9.1 | NA | CVE Not Used 288d | -| CVE-2026-2332 | jetty-http@9.4.5.v20170502 | 9.1 | NA | Library Unused | -| CVE-2026-40477 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | CVE Not Used 288d | -| CVE-2026-40478 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | CVE Not Used 288d | -| CVE-2025-67030 | plexus-utils@3.0.8 | 8.8 | NA | Library Unused | -| CVE-2023-22102 | mysql-connector-java@5.1.42 | 8.3 | NA | CVE Not Used 288d | -| CVE-2024-22262 | spring-web@4.3.9.RELEASE | 8.1 | NA | CVE Not Used 288d | -| CVE-2022-27772 | spring-boot@1.5.4.RELEASE | 7.8 | NA | CVE Not Used 288d | -| CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | CVE Not Used 288d | -| CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | CVE Not Used 288d | -| CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Library Unused | -| CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Library Unused | -| CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | CVE Not Used 288d | -| CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Library Unused | -| CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | CVE Not Used 288d | -| CVE-2023-20861 | spring-expression@4.3.9.RELEASE | 6.5 | NA | CVE Not Used 288d | -| CVE-2023-34055 | spring-boot-actuator@1.5.4.RELEASE | 6.5 | NA | CVE Not Used 288d | -| CVE-2019-2692 | mysql-connector-java@5.1.42 | 6.3 | NA | CVE Not Used 288d | -| CVE-2018-1196 | spring-boot@1.5.4.RELEASE | 5.9 | NA | CVE Not Used 288d | -| CVE-2022-38750 | snakeyaml@1.17 | 5.5 | NA | Library Unused | -| CVE-2024-38820 | spring-web@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2024-38809 | spring-web@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2025-61795 | tomcat-embed-core@8.5.15 | 5.3 | NA | CVE Not Used 288d | -| CVE-2024-6763 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Library Unused | -| CVE-2023-40167 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Library Unused | -| CVE-2020-14338 | xercesimpl@2.11.0 | 5.3 | NA | CVE Not Used 288d | -| CVE-2019-3797 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2019-3802 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2024-38820 | spring-context@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2022-4245 | plexus-utils@3.0.8 | 4.3 | NA | Library Unused | -| CVE-2021-22096 | spring-core@4.3.9.RELEASE | 4.3 | NA | CVE Not Used 288d | -| CVE-2024-38808 | spring-expression@4.3.9.RELEASE | 4.3 | NA | CVE Not Used 288d | -| CVE-2024-47554 | commons-io@2.4 | 4.3 | NA | Library Unused | -| CVE-2020-8908 | guava@19.0 | 3.3 | NA | CVE Not Used 288d | -| CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Library Unused | -| CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | CVE Not Used 288d | -| CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | CVE Not Used 288d | -| CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | CVE Not Used 288d | -| CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Library Unused | -| CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2026-41842 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2026-43513 | tomcat-embed-core@8.5.15 | 7.5 | NA | CVE Not Used 288d | -| CVE-2026-41848 | spring-core@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2026-41850 | spring-expression@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2026-41851 | spring-expression@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2026-41849 | spring-expression@4.3.9.RELEASE | 7.5 | NA | CVE Not Used 288d | -| CVE-2025-22235 | spring-boot@1.5.4.RELEASE | 7.3 | NA | CVE Not Used 288d | -| CVE-2023-2976 | guava@19.0 | 7.1 | NA | CVE Not Used 288d | -| CVE-2026-40973 | spring-boot@1.5.4.RELEASE | 7.0 | NA | CVE Not Used 288d | -| CVE-2017-7536 | hibernate-validator@5.3.5.Final | 7.0 | NA | CVE Not Used 288d | -| CVE-2025-11143 | jetty-http@9.4.5.v20170502 | 6.5 | NA | Library Unused | -| CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | CVE Not Used 288d | -| CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | CVE Not Used 288d | -| CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | CVE Not Used 288d | -| CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | CVE Not Used 288d | -| CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | CVE Not Used 288d | -| CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | CVE Not Used 288d | -| CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | CVE Not Used 288d | -| CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Library Unused | -| CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | CVE Not Used 288d | -| CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | CVE Not Used 288d | -| CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | CVE Not Used 288d | -| CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | CVE Not Used 288d | -| CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | -| CVE-2026-1225 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | -| CVE-2026-9828 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | -| CVE-2025-11226 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | -| CVE-2024-12798 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | -| CVE-2024-12801 | logback-core@1.1.11 | 0.0 | NA | CVE Not Used 288d | +**Risk Level:** HIGH + +**Protection Status:** Assess (runtime evidence): dev=enabled, qa=no data, prod=enabled · ADR (classic RASP, formerly "Protect" - not CVE Shield): dev=disabled, qa=no data, prod=enabled + +SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-databind 2.8.8, tomcat-embed-core 8.5.15, spring-framework 4.3.9, spring-data-commons, hibernate, netty, snakeyaml, etc.), almost all resolved to not_affected. Assess has real runtime coverage in dev and prod (qa has no data, but claims are scoped across all three so dev/prod evidence still backs them), and ADR is enabled in prod but disabled in dev. Most claims rest on solid ground (either code_not_reachable, i.e. zero classes loaded, or duration-based acceptance backed by a CVE Shield backstop and modest EPSS), but a meaningful subset of claims sit on duration-only reasoning for CVEs that are either KEV-listed, have very high EPSS, or have zero CVE Shield coverage at all - those warrant a second look before being relied on as-is. + +**Risk Rationale:** Several claims accept CVE-2022-22965 (Spring4Shell), CVE-2020-1938 (Ghostcat), CVE-2017-12617, CVE-2023-44487 (HTTP/2 Rapid Reset), and CVE-2025-24813 as not_affected using only 'no observed execution in 288 days' reasoning - all five are CISA KEV-listed with EPSS at or near 1.0, meaning they are being actively exploited in the wild, and the libraries involved (spring-webmvc, spring-beans, tomcat-embed-core) are heavily loaded (166-387 classes used), so this isn't a dormant/unused dependency. Separately, seven CVEs on tomcat-embed-core, hibernate-validator, and tomcat-embed-websocket have zero CVE Shield coverage in this environment scope while being critical/high severity, meaning there is no active mitigation as a backstop if the absence-of-execution reasoning is wrong - one of these (CVE-2020-13935) also has a very high EPSS (0.87). ADR being disabled in dev further weakens the safety net for any of these claims that turn out to be wrong in that tier. None of this indicates the VEX tool is behaving incorrectly - the reasoning and thresholds are applied consistently - but the specific CVEs above carry enough real-world exploitation weight that a human should confirm reachability before treating them as settled. + +**Recommendation:** Have a human reviewer confirm reachability (not just absence-of-execution) for the five KEV-listed CVEs (CVE-2022-22965 on spring-webmvc/spring-beans, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487, CVE-2025-24813 on tomcat-embed-core) before relying on the not_affected claims, given active-exploitation status and heavy class loading. Also review the seven CVE-Shield-uncovered critical/high findings (CVE-2026-41293, CVE-2025-66614, CVE-2020-11996, CVE-2026-24880, CVE-2026-42498 on tomcat-embed-core; CVE-2020-13935 on tomcat-embed-websocket; CVE-2025-35036 on hibernate-validator) since there's no active backstop if the duration-based call is wrong. Given the volume of tomcat-embed-core and jackson-databind CVEs stacked on ancient versions, prioritize the upgrade path over continued risk acceptance. Consider enabling ADR in dev to restore a mitigating control tier-wide. + +| CVE | Library | Score | VEX | Shield | Rationale | +|-----|---------|-------|-----|--------|-----------| +| CVE-2022-22965 | spring-boot-starter-web@1.5.4.RELEASE | 9.8 | NA | Yes | Library Unused | +| CVE-2022-22965 | spring-webmvc@4.3.9.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2022-22965 | spring-beans@4.3.9.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2025-24813 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-12617 | tomcat-embed-core@8.5.15 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2023-44487 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2020-1938 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1273 | spring-data-commons@1.13.4.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Yes | Library Unused | +| CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | Yes | CVE Not Used 288d | +| CVE-2020-13935 | tomcat-embed-websocket@8.5.15 | 7.5 | NA | No | CVE Not Used 288d | +| CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-55752 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-31650 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-48988 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2020-9484 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | +| CVE-2024-38819 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2017-17485 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-0221 | tomcat-embed-core@8.5.15 | 6.1 | NA | Yes | CVE Not Used 288d | +| CVE-2019-12384 | jackson-databind@2.8.8 | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2024-50379 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-7525 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2022-22950 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1271 | spring-core@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Yes | Library Unused | +| CVE-2020-11996 | tomcat-embed-core@8.5.15 | 7.5 | NA | No | CVE Not Used 288d | +| CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2018-8014 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-12086 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36179 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2018-8034 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1336 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-7489 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2021-21295 | netty@3.5.7.Final | 5.9 | NA | Yes | Library Unused | +| CVE-2020-9548 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-9547 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-25649 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-25122 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1304 | tomcat-embed-core@8.5.15 | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2012-0881 | xercesimpl@2.11.0 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2019-8331 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2018-1305 | tomcat-embed-core@8.5.15 | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2024-21733 | tomcat-embed-core@8.5.15 | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2018-14718 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-20445 | netty@3.5.7.Final | 9.1 | NA | Yes | Library Unused | +| CVE-2020-35728 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2021-36090 | commons-compress@1.9 | 7.5 | NA | Yes | Library Unused | +| CVE-2022-25647 | gson@2.8.0 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-35516 | commons-compress@1.9 | 7.5 | NA | Yes | Library Unused | +| CVE-2021-35515 | commons-compress@1.9 | 7.5 | NA | Yes | Library Unused | +| CVE-2022-23437 | xercesimpl@2.11.0 | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-14540 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2018-19361 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2018-19360 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2018-19362 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36188 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2019-14439 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-17563 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-35517 | commons-compress@1.9 | 7.5 | NA | Yes | Library Unused | +| CVE-2019-12814 | jackson-databind@2.8.8 | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2018-8037 | tomcat-embed-core@8.5.15 | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2018-14721 | jackson-databind@2.8.8 | 10.0 | NA | Yes | CVE Not Used 288d | +| CVE-2018-14719 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36184 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2021-29425 | commons-io@2.4 | 4.8 | NA | No | Library Unused | +| CVE-2019-20330 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-20444 | netty@3.5.7.Final | 9.1 | NA | Yes | Library Unused | +| CVE-2020-35491 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-24616 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2018-12023 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | +| CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Yes | Library Unused | +| CVE-2020-1935 | tomcat-embed-core@8.5.15 | 4.8 | NA | No | CVE Not Used 288d | +| CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-5929 | logback-core@1.1.11 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-5929 | logback-classic@1.1.11 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-10673 | jackson-databind@2.8.8 | 8.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-35490 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2019-16869 | netty@3.5.7.Final | 7.5 | NA | Yes | Library Unused | +| CVE-2020-10683 | dom4j@1.6.1 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2021-20190 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2018-5968 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-24750 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2018-12022 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1000632 | dom4j@1.6.1 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-37137 | netty@3.5.7.Final | 7.5 | NA | Yes | Library Unused | +| CVE-2018-11307 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-14892 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Yes | Library Unused | +| CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Yes | Library Unused | +| CVE-2023-41080 | tomcat-embed-core@8.5.15 | 6.1 | NA | No | CVE Not Used 288d | +| CVE-2023-45648 | tomcat-embed-core@8.5.15 | 5.3 | NA | No | CVE Not Used 288d | +| CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-17267 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-17531 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36182 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36180 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36186 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36181 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36185 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36187 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36189 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36183 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-5529 | htmlunit@2.21 | 8.1 | NA | Yes | Library Unused | +| CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Yes | Library Unused | +| CVE-2018-10237 | guava@19.0 | 5.9 | NA | No | CVE Not Used 288d | +| CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Yes | Library Unused | +| CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Yes | Library Unused | +| CVE-2022-41853 | hsqldb@2.3.5 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2025-31651 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2018-3258 | mysql-connector-java@5.1.42 | 8.8 | NA | Yes | CVE Not Used 288d | +| CVE-2024-22243 | spring-web@4.3.9.RELEASE | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2021-42550 | logback-core@1.1.11 | 6.6 | NA | Yes | CVE Not Used 288d | +| CVE-2018-14042 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2018-14040 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2016-10735 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2018-20677 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2018-20676 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2023-26119 | htmlunit@2.21 | 9.8 | NA | Yes | Library Unused | +| CVE-2020-10650 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2024-22259 | spring-web@4.3.9.RELEASE | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2022-42004 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2022-42003 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2022-25857 | snakeyaml@1.17 | 7.5 | NA | Yes | Library Unused | +| CVE-2023-46589 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-49125 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1272 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-11040 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2020-25638 | hibernate-core@5.0.4.Final | 7.4 | NA | Yes | CVE Not Used 288d | +| CVE-2025-46701 | tomcat-embed-core@8.5.15 | 7.3 | NA | Yes | CVE Not Used 288d | +| CVE-2022-38752 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | +| CVE-2021-43797 | netty@3.5.7.Final | 6.5 | NA | Yes | Library Unused | +| CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41293 | tomcat-embed-core@8.5.15 | 9.8 | NA | No | CVE Not Used 288d | +| CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-53506 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-52520 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2022-28366 | neko-htmlunit@2.21 | 7.5 | NA | No | Library Unused | +| CVE-2022-38749 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | +| CVE-2022-38751 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | +| CVE-2019-14900 | hibernate-core@5.0.4.Final | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2024-23672 | tomcat-embed-websocket@8.5.15 | 6.3 | NA | Yes | CVE Not Used 288d | +| CVE-2021-21290 | netty@3.5.7.Final | 5.5 | NA | Yes | Library Unused | +| CVE-2020-15250 | junit@4.12 | 5.5 | NA | Yes | Library Unused | +| CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2020-10693 | hibernate-validator@5.3.5.Final | 5.3 | NA | No | CVE Not Used 288d | +| CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Yes | Library Unused | +| CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Yes | Library Unused | +| CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2026-43515 | tomcat-embed-core@8.5.15 | 9.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-2332 | jetty-http@9.4.5.v20170502 | 9.1 | NA | Yes | Library Unused | +| CVE-2026-40477 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-40478 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Yes | CVE Not Used 288d | +| CVE-2025-67030 | plexus-utils@3.0.8 | 8.8 | NA | Yes | Library Unused | +| CVE-2023-22102 | mysql-connector-java@5.1.42 | 8.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-22262 | spring-web@4.3.9.RELEASE | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2022-27772 | spring-boot@1.5.4.RELEASE | 7.8 | NA | Yes | CVE Not Used 288d | +| CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-24880 | tomcat-embed-core@8.5.15 | 7.5 | NA | No | CVE Not Used 288d | +| CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Yes | Library Unused | +| CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Yes | Library Unused | +| CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-42498 | tomcat-embed-core@8.5.15 | 7.3 | NA | No | CVE Not Used 288d | +| CVE-2025-35036 | hibernate-validator@5.3.5.Final | 7.3 | NA | No | CVE Not Used 288d | +| CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | +| CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | +| CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2023-20861 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2023-34055 | spring-boot-actuator@1.5.4.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-2692 | mysql-connector-java@5.1.42 | 6.3 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1196 | spring-boot@1.5.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2022-38750 | snakeyaml@1.17 | 5.5 | NA | Yes | Library Unused | +| CVE-2024-38820 | spring-web@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-38809 | spring-web@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2025-61795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-6763 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Yes | Library Unused | +| CVE-2023-40167 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Yes | Library Unused | +| CVE-2020-14338 | xercesimpl@2.11.0 | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2019-3797 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2019-3802 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-38820 | spring-context@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2022-4245 | plexus-utils@3.0.8 | 4.3 | NA | Yes | Library Unused | +| CVE-2021-22096 | spring-core@4.3.9.RELEASE | 4.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-38808 | spring-expression@4.3.9.RELEASE | 4.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-47554 | commons-io@2.4 | 4.3 | NA | Yes | Library Unused | +| CVE-2020-8908 | guava@19.0 | 3.3 | NA | Yes | CVE Not Used 288d | +| CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Yes | Library Unused | +| CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2025-66614 | tomcat-embed-core@8.5.15 | 9.1 | NA | No | CVE Not Used 288d | +| CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Yes | Library Unused | +| CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41842 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-43513 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41848 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41850 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41851 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41849 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-22235 | spring-boot@1.5.4.RELEASE | 7.3 | NA | Yes | CVE Not Used 288d | +| CVE-2023-2976 | guava@19.0 | 7.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-40973 | spring-boot@1.5.4.RELEASE | 7.0 | NA | Yes | CVE Not Used 288d | +| CVE-2017-7536 | hibernate-validator@5.3.5.Final | 7.0 | NA | Yes | CVE Not Used 288d | +| CVE-2025-11143 | jetty-http@9.4.5.v20170502 | 6.5 | NA | Yes | Library Unused | +| CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | +| CVE-2023-1932 | hibernate-validator@5.3.5.Final | 6.1 | NA | No | CVE Not Used 288d | +| CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Yes | Library Unused | +| CVE-2026-54515 | jackson-databind@2.8.8 | 5.3 | NA | No | CVE Not Used 288d | +| CVE-2026-54514 | jackson-databind@2.8.8 | 5.3 | NA | No | CVE Not Used 288d | +| CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-43514 | tomcat-embed-core@8.5.15 | 3.7 | NA | No | CVE Not Used 288d | +| CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | Yes | CVE Not Used 288d | +| CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-1225 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-9828 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2025-11226 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2024-12798 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2024-12801 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | --- ## Appendix: Methodology -VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This advisor does not change any claim; it only assesses whether relying on each claim as generated is reasonable given the CVE's severity and exploitability - it doesn't offer a distinct action per claim, since the real options (verify reachability, upgrade the library) are the same regardless of severity. See the Legend above for how the VEX/Rationale columns are derived, and the Key Findings above for which specific CVEs are CISA KEV-listed or high-EPSS. +VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and per-environment CVE Shield status - see `vex --help` for the exact decision policy. This advisor does not change any claim; it only assesses whether relying on each claim as generated is reasonable given the CVE's severity and exploitability - it doesn't offer a distinct action per claim, since the real options (verify reachability, upgrade the library) are the same regardless of severity. See the Legend above for how the VEX/Rationale columns are derived, and the Key Findings above for which specific CVEs are CISA KEV-listed or high-EPSS. - **sound**: the claim's justification (structural fact or active control, or a duration comfortably past the threshold on a low-stakes CVE) supports relying on it as-is - **needs_review**: the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or is otherwise borderline - a human should confirm before treating it as resolved diff --git a/samples/sample-vex.json b/samples/sample-vex.json index a4cd6ea..ee990fc 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -3,7 +3,7 @@ "specVersion": "1.6", "version": 1, "metadata": { - "timestamp": "2026-09-03T02:10:38Z", + "timestamp": "2026-09-03T02:41:45Z", "component": { "type": "application", "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", @@ -22,15 +22,15 @@ "value": "true" }, { - "name": "contrast:protectEnabledDev", + "name": "contrast:adrEnabledDev", "value": "false" }, { - "name": "contrast:protectEnabledQa", + "name": "contrast:adrEnabledQa", "value": "" }, { - "name": "contrast:protectEnabledProd", + "name": "contrast:adrEnabledProd", "value": "true" } ] @@ -55,15 +55,15 @@ "value": "true" }, { - "name": "contrast:protectEnabledDev", + "name": "contrast:adrEnabledDev", "value": "false" }, { - "name": "contrast:protectEnabledQa", + "name": "contrast:adrEnabledQa", "value": "" }, { - "name": "contrast:protectEnabledProd", + "name": "contrast:adrEnabledProd", "value": "true" } ] @@ -154,6 +154,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -172,11 +176,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity jackson-databind CVE waived on 288-day absence-of-execution only, no structural non-reachability guarantee." + "value": "Critical CVE but EPSS is low (0.1) and CVE Shield is available as a backstop; 288 days comfortably exceeds the 30-day threshold." } ] }, @@ -264,6 +268,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -282,11 +290,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification; should be manually confirmed before relying on it." + "value": "Low EPSS, Shield available as backstop, duration well past threshold." } ] }, @@ -374,6 +382,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -396,7 +408,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with elevated EPSS (0.5, 98.81 pct); duration-only absence-of-execution reasoning is weak evidence for this exploitability profile." + "value": "EPSS 0.5 (98.81 percentile) is notably high for a critical CVE relying only on duration-based reasoning; worth confirming reachability despite Shield coverage." } ] }, @@ -484,6 +496,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -502,11 +518,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification with no code_not_reachable backing." + "value": "Moderate EPSS (0.27), Shield backstop present, duration well past threshold." } ] }, @@ -594,6 +610,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -612,11 +632,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE accepted purely on non-execution duration; warrants confirmation." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -704,6 +724,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -722,11 +746,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-based claim only; not a structural guarantee." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -814,6 +838,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -832,11 +860,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -924,6 +952,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -942,11 +974,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -1034,6 +1066,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -1052,11 +1088,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -1144,6 +1180,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -1162,11 +1202,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Moderate EPSS, Shield backstop present." } ] }, @@ -1254,6 +1294,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -1272,11 +1316,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -1364,6 +1408,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -1382,11 +1430,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Moderate EPSS, Shield backstop present." } ] }, @@ -1474,6 +1522,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -1492,11 +1544,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -1584,6 +1636,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -1602,11 +1658,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -1694,6 +1750,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -1712,11 +1772,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -1804,6 +1864,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -1822,11 +1886,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -1914,6 +1978,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -1932,11 +2000,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -2024,6 +2092,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -2042,11 +2114,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -2134,6 +2206,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -2152,11 +2228,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -2244,6 +2320,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -2262,11 +2342,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with meaningful EPSS (0.38, 98.44 pct); duration-only claim is weaker evidence here." + "value": "EPSS 0.38 is elevated but below the flag threshold, and Shield is available; acceptable to rely on as-is but not far from warranting a check." } ] }, @@ -2354,6 +2434,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -2372,11 +2456,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Moderate EPSS, Shield backstop present." } ] }, @@ -2464,6 +2548,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -2482,11 +2570,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -2574,6 +2662,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -2592,11 +2684,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -2684,6 +2776,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -2702,11 +2798,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only reasoning; should be reviewed." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -2794,6 +2890,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -2812,11 +2912,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE waived solely on non-execution duration." + "value": "Low EPSS, high severity but Shield backstop present." } ] }, @@ -2904,6 +3004,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -2922,11 +3026,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -3014,6 +3118,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -3032,11 +3140,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -3124,6 +3232,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -3142,11 +3254,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -3234,6 +3346,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -3252,11 +3368,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -3344,6 +3460,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -3362,11 +3482,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -3454,6 +3574,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -3472,11 +3596,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -3564,6 +3688,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -3582,11 +3710,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -3674,6 +3802,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -3692,11 +3824,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -3784,6 +3916,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -3802,11 +3938,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.21 (97.39 pct); duration-only claim should be verified." + "value": "Moderate EPSS, Shield backstop present." } ] }, @@ -3894,6 +4030,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -3912,11 +4052,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -4004,6 +4144,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -4022,11 +4166,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -4114,6 +4258,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -4132,11 +4280,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -4224,6 +4372,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -4242,11 +4394,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -4334,6 +4486,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -4352,11 +4508,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -4444,6 +4600,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -4462,11 +4622,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -4554,6 +4714,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -4572,11 +4736,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -4664,6 +4828,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -4682,11 +4850,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -4774,6 +4942,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -4792,11 +4964,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -4884,6 +5056,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -4902,11 +5078,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -4994,6 +5170,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -5012,11 +5192,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -5104,6 +5284,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -5122,11 +5306,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -5214,6 +5398,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -5232,11 +5420,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.18; duration-only justification warrants review." + "value": "Moderate EPSS, Shield backstop present." } ] }, @@ -5324,6 +5512,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -5342,11 +5534,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -5434,6 +5626,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -5452,11 +5648,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -5544,6 +5740,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -5562,11 +5762,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -5654,6 +5854,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -5672,11 +5876,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -5764,6 +5968,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -5782,11 +5990,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.22; duration-only justification warrants review." + "value": "Moderate EPSS, Shield backstop present." } ] }, @@ -5874,6 +6082,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -5896,7 +6108,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity accepted on duration alone; lower stakes if wrong, acceptable as-is despite elevated EPSS." + "value": "Medium severity, lower stakes for duration-only acceptance." } ] }, @@ -5984,6 +6196,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -6006,7 +6222,235 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity accepted on duration alone; acceptable as-is." + "value": "Medium severity, lower stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-54515-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2026-54515", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2026-54515. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "27.36" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NO_SHIELD" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NO_SHIELD" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity with no Shield coverage - lower stakes given severity, so duration-only acceptance is reasonable here." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-54514-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2026-54514", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2026-54514. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "29.75" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NO_SHIELD" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NO_SHIELD" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Medium severity with no Shield coverage - lower stakes given severity." } ] }, @@ -6092,6 +6536,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.70.0" @@ -6114,7 +6562,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable with 0 of 1295 classes ever loaded - a structural fact regardless of critical severity." + "value": "code_not_reachable (0 of 1295 classes loaded) - structural fact, safe to rely on regardless of severity." } ] }, @@ -6200,6 +6648,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.70.0" @@ -6222,7 +6674,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 classes loaded; structural non-reachability holds regardless of severity." + "value": "code_not_reachable - structural fact." } ] }, @@ -6310,6 +6762,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "20040902.021138" @@ -6328,11 +6784,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity dom4j CVE; only 1 of 190 classes loaded but claim rests on duration, not code_not_reachable - worth confirming the loaded class isn\u0027t the vulnerable one." + "value": "Only 1 of 190 classes loaded, low EPSS, Shield backstop present." } ] }, @@ -6420,6 +6876,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "20040902.021138" @@ -6438,11 +6898,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification despite minimal library usage." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -6528,6 +6988,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.6" @@ -6550,7 +7014,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 206 classes loaded - structural fact holds even given critical severity and EPSS 1.0/KEV-adjacent profile." + "value": "code_not_reachable (0 of 206 classes) - structural fact; safe despite EPSS 1.0 since the classes were never loaded." } ] }, @@ -6636,6 +7100,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.6" @@ -6658,7 +7126,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe to trust." + "value": "code_not_reachable - structural fact." } ] }, @@ -6744,6 +7212,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.6" @@ -6766,7 +7238,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe to trust." + "value": "code_not_reachable - structural fact." } ] }, @@ -6852,6 +7324,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.6" @@ -6874,7 +7350,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe to trust." + "value": "code_not_reachable, medium severity." } ] }, @@ -6960,6 +7436,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.6" @@ -6982,7 +7462,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe to trust." + "value": "code_not_reachable, medium severity." } ] }, @@ -7068,6 +7548,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.6" @@ -7090,7 +7574,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe to trust." + "value": "code_not_reachable, medium severity." } ] }, @@ -7176,6 +7660,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.6" @@ -7198,7 +7686,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe to trust." + "value": "code_not_reachable, medium severity." } ] }, @@ -7284,6 +7772,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.6" @@ -7306,7 +7798,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability, safe to trust." + "value": "code_not_reachable, medium severity." } ] }, @@ -7392,6 +7884,10 @@ "name": "contrast:cisaKev", "value": "true" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.1.0" @@ -7414,7 +7910,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-beans: KEV-listed critical Spring4Shell CVE waived on duration only, with 202 of 408 classes actively loaded - warrants confirmation." + "value": "Spring-beans: CISA KEV-listed Spring4Shell, EPSS 1.0, 202/408 classes loaded - active exploitation in the wild means duration-only reasoning should be double-checked here too." } ] }, @@ -7502,6 +7998,10 @@ "name": "contrast:cisaKev", "value": "true" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.1.0" @@ -7524,7 +8024,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed critical CVE with EPSS 0.97 waived purely on 288-day duration reasoning, not code_not_reachable; this is exactly the highest-stakes pattern to double-check." + "value": "CISA KEV-listed, EPSS 0.97, and the claim rests only on 288-day absence-of-execution with 152/554 classes actively loaded - active exploitation in the wild plus real usage of the library warrants human confirmation of reachability." } ] }, @@ -7612,6 +8112,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.1.0" @@ -7630,11 +8134,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on same actively-loaded library as the KEV CVE above." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -7722,6 +8226,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.1.0" @@ -7740,11 +8248,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification; low EPSS somewhat mitigates but still worth a look given severity." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -7832,6 +8340,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.1.0" @@ -7854,7 +8366,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity accepted on duration alone with near-zero EPSS; acceptable as-is." + "value": "Medium severity, lower stakes." } ] }, @@ -7942,6 +8454,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.1.0" @@ -7964,7 +8480,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity accepted on duration alone with near-zero EPSS; acceptable as-is." + "value": "Medium severity, lower stakes." } ] }, @@ -8050,6 +8566,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.1.0" @@ -8072,7 +8592,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated (0.0); duration-only acceptance is low-stakes here." + "value": "Unknown/no severity score, low stakes." } ] }, @@ -8160,6 +8680,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.7.4" @@ -8178,11 +8702,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity hsqldb CVE waived on duration only, with substantial library usage (229 of 601 classes) increasing uncertainty about whether the vulnerable path was truly untriggered." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -8270,6 +8794,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -8288,11 +8816,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: critical severity, duration-only justification." + "value": "logback-classic: low EPSS, Shield backstop present." } ] }, @@ -8380,6 +8908,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -8398,11 +8930,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: high severity, duration-only justification." + "value": "logback-classic: very low EPSS, Shield backstop present." } ] }, @@ -8490,6 +9022,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -8512,7 +9048,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity accepted on duration alone; acceptable as-is." + "value": "Medium severity, lower stakes." } ] }, @@ -8598,6 +9134,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -8620,7 +9160,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated; duration-only acceptance is low-stakes." + "value": "No severity score assigned, low stakes." } ] }, @@ -8706,6 +9246,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -8728,7 +9272,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated; duration-only acceptance is low-stakes." + "value": "No severity score assigned, low stakes." } ] }, @@ -8814,6 +9358,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -8836,7 +9384,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated; duration-only acceptance is low-stakes." + "value": "No severity score assigned, low stakes." } ] }, @@ -8922,6 +9470,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -8944,7 +9496,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated; duration-only acceptance is low-stakes." + "value": "No severity score assigned, low stakes." } ] }, @@ -9030,6 +9582,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -9052,7 +9608,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated; duration-only acceptance is low-stakes." + "value": "No severity score assigned, low stakes." } ] }, @@ -9138,6 +9694,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -9160,7 +9720,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated; duration-only acceptance is low-stakes." + "value": "No severity score assigned, low stakes." } ] }, @@ -9248,6 +9808,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -9266,11 +9830,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-web: critical severity with meaningful EPSS (0.32); duration-only justification warrants review." + "value": "EPSS 0.32 is elevated but below flag threshold, Shield backstop present." } ] }, @@ -9358,6 +9922,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -9376,11 +9944,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-web: high severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -9468,6 +10036,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -9486,11 +10058,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-web: high severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -9578,6 +10150,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -9596,11 +10172,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-web: high severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, @@ -9688,6 +10264,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -9710,7 +10290,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity accepted on duration alone; acceptable as-is." + "value": "Medium severity, lower stakes." } ] }, @@ -9798,6 +10378,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -9820,7 +10404,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-context: medium severity, duration-only acceptance is low-stakes." + "value": "spring-context: medium severity, lower stakes." } ] }, @@ -9908,6 +10492,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -9930,7 +10518,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity accepted on duration alone; acceptable as-is." + "value": "Medium severity, lower stakes." } ] }, @@ -10018,6 +10606,10 @@ "name": "contrast:cisaKev", "value": "true" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -10040,7 +10632,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-beans: KEV-listed critical Spring4Shell CVE waived on duration only, with 202 of 408 classes actively loaded - warrants confirmation." + "value": "Spring-beans: CISA KEV-listed Spring4Shell, EPSS 1.0, 202/408 classes loaded - active exploitation in the wild means duration-only reasoning should be double-checked here too." } ] }, @@ -10128,6 +10720,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -10146,11 +10742,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on an actively-used library." + "value": "Very low EPSS, Shield backstop present." } ] }, @@ -10238,6 +10834,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -10260,7 +10860,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.55); duration-only justification should be confirmed." + "value": "EPSS 0.55 on a high-severity spring-webmvc CVE actively loaded (166/498 classes) - elevated exploitation likelihood warrants a closer look despite Shield coverage." } ] }, @@ -10348,6 +10948,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -10370,7 +10974,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -10458,6 +11062,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -10480,7 +11088,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -10568,6 +11176,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -10590,7 +11202,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -10678,6 +11290,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -10700,7 +11316,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -10788,6 +11404,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -10810,7 +11430,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -10898,6 +11518,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -10920,7 +11544,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -11008,6 +11632,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -11030,7 +11658,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -11118,6 +11746,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -11140,7 +11772,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, duration-only acceptance is low-stakes." + "value": "Low severity, lower stakes." } ] }, @@ -11228,6 +11860,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -11246,11 +11882,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: critical severity, duration-only justification." + "value": "logback-classic: low EPSS, Shield backstop present." } ] }, @@ -11338,6 +11974,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.5.38" @@ -11356,11 +11996,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: high severity, duration-only justification." + "value": "logback-classic: very low EPSS, Shield backstop present." } ] }, @@ -11448,6 +12088,10 @@ "name": "contrast:cisaKev", "value": "true" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -11470,7 +12114,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-beans: KEV-listed critical Spring4Shell CVE waived on duration only, with 202 of 408 classes actively loaded - warrants confirmation." + "value": "Spring-beans: CISA KEV-listed Spring4Shell, EPSS 1.0, 202/408 classes loaded - active exploitation in the wild means duration-only reasoning should be double-checked here too." } ] }, @@ -11558,6 +12202,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -11580,7 +12228,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -11668,6 +12316,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -11686,11 +12338,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: critical severity, duration-only justification with EPSS 0.22." + "value": "Moderate EPSS, Shield backstop present." } ] }, @@ -11778,6 +12430,10 @@ "name": "contrast:cisaKev", "value": "true" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -11800,7 +12456,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed critical Tomcat RCE with EPSS 1.0, waived purely on non-execution duration - highest-priority item to confirm manually." + "value": "CISA KEV-listed, EPSS 1.0, tomcat-embed-core is heavily loaded (387/1481 classes) - critical actively-exploited RCE relying solely on absence-of-execution needs human confirmation." } ] }, @@ -11888,6 +12544,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -11906,26 +12566,26 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-1938-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2020-1938", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41293-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-41293", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293" }, "score": 9.8, "severity": "critical", @@ -11933,14 +12593,14 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-1938. Latest available release is 10.1.57.", + "description": "Improper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-41293. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { @@ -11988,15 +12648,19 @@ }, { "name": "contrast:epssScore", - "value": "0.99" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "99.94" + "value": "73.56" }, { "name": "contrast:cisaKev", - "value": "true" + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "false" }, { "name": "contrast:latestVersion", @@ -12004,7 +12668,7 @@ }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -12012,7 +12676,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -12020,22 +12684,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed critical GhostCat vulnerability with EPSS 0.99, waived on duration alone - should be manually verified, not left as-is." + "value": "Critical severity with zero CVE Shield coverage in this environment scope - no active mitigation backstop if the duration-based reasoning is wrong." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-31651-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-31651", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-1938-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2020-1938", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31651" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31651" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938" }, "score": 9.8, "severity": "critical", @@ -12043,8 +12707,8 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible \nfor a specially crafted request to bypass some rewrite rules. If those \nrewrite rules effectively enforced security constraints, those \nconstraints could be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-31651. Latest available release is 10.1.57.", + "description": "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-1938. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -12098,15 +12762,19 @@ }, { "name": "contrast:epssScore", - "value": "0.04" + "value": "0.99" }, { "name": "contrast:epssPercentile", - "value": "89.92" + "value": "99.94" }, { "name": "contrast:cisaKev", - "value": "false" + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" }, { "name": "contrast:latestVersion", @@ -12130,22 +12798,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "CISA KEV-listed Ghostcat, EPSS 0.99, tomcat-embed-core heavily loaded - active exploitation in the wild, duration-only claim needs confirmation." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-50379-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2024-50379", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-31651-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-31651", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50379" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31651" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50379" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31651" }, "score": 9.8, "severity": "critical", @@ -12153,8 +12821,8 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-50379. Latest available release is 10.1.57.", + "description": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible \nfor a specially crafted request to bypass some rewrite rules. If those \nrewrite rules effectively enforced security constraints, those \nconstraints could be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-31651. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -12208,16 +12876,20 @@ }, { "name": "contrast:epssScore", - "value": "0.44" + "value": "0.04" }, { "name": "contrast:epssPercentile", - "value": "98.67" + "value": "89.92" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -12236,35 +12908,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with elevated EPSS (0.44); duration-only justification warrants review." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43515-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2026-43515", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-50379-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-50379", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50379" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50379" }, - "score": 9.1, + "score": 9.8, "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43515. Latest available release is 10.1.57.", + "description": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-50379. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -12318,16 +12990,20 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.44" }, { "name": "contrast:epssPercentile", - "value": "64.31" + "value": "98.67" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -12346,35 +13022,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "EPSS 0.44 is elevated but below flag threshold; Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0232-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2019-0232", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43515-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-43515", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0232" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0232" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515" }, - "score": 8.1, - "severity": "high", + "score": 9.1, + "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange\u0027s blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0232. Latest available release is 10.1.57.", + "description": "Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43515. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -12428,16 +13104,20 @@ }, { "name": "contrast:epssScore", - "value": "1.0" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "99.95" + "value": "64.31" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -12456,41 +13136,41 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 1.0; duration-only claim should be verified." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-12617-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2017-12617", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-66614-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-66614", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614" }, - "score": 8.1, - "severity": "high", + "score": 9.1, + "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2017-12617. Latest available release is 10.1.57.", + "description": "Improper Input Validation vulnerability.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.\nTomcat did not validate that the host name provided via the SNI \nextension was the same as the host name provided in the HTTP host header \nfield. If Tomcat was configured with more than one virtual host and the \nTLS configuration for one of those hosts did not require client \ncertificate authentication but another one did, it was possible for a \nclient to bypass the client certificate authentication by sending \ndifferent host names in the SNI extension and the HTTP host header field.\n\n\n\nThe vulnerability only applies if client certificate authentication is \nonly enforced at the Connector. It does not apply if client certificate \nauthentication is enforced at the web application.\n\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-66614. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { @@ -12538,15 +13218,19 @@ }, { "name": "contrast:epssScore", - "value": "1.0" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "99.98" + "value": "14.35" }, { "name": "contrast:cisaKev", - "value": "true" + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "false" }, { "name": "contrast:latestVersion", @@ -12554,7 +13238,7 @@ }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -12562,7 +13246,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -12570,31 +13254,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed high severity RCE with EPSS 1.0, waived purely on duration - should be manually confirmed." + "value": "Critical severity with zero CVE Shield coverage - no active backstop; runtime observation is the only signal." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0199-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2019-0199", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0232-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-0232", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0232" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0232" }, - "score": 7.5, + "score": 8.1, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0199. Latest available release is 10.1.57.", + "description": "When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange\u0027s blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0232. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -12648,16 +13332,20 @@ }, { "name": "contrast:epssScore", - "value": "0.73" + "value": "1.0" }, { "name": "contrast:epssPercentile", - "value": "99.41" + "value": "99.95" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -12680,31 +13368,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.73); duration-only justification warrants review." + "value": "EPSS 1.0 on a high-severity CVE with the library heavily loaded - very high exploitation likelihood warrants confirmation despite Shield coverage." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8034-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-8034", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-12617-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2017-12617", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8034" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8034" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617" }, - "score": 7.5, + "score": 8.1, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8034. Latest available release is 10.1.57.", + "description": "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2017-12617. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -12758,15 +13446,19 @@ }, { "name": "contrast:epssScore", - "value": "0.21" + "value": "1.0" }, { "name": "contrast:epssPercentile", - "value": "97.43" + "value": "99.98" }, { "name": "contrast:cisaKev", - "value": "false" + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" }, { "name": "contrast:latestVersion", @@ -12790,31 +13482,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "CISA KEV-listed, EPSS 1.0 - actively exploited RCE; duration-only reasoning should be confirmed." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-17563-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2019-17563", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0199-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-0199", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17563" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17563" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-17563. Latest available release is 10.1.57.", + "description": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0199. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -12868,16 +13560,20 @@ }, { "name": "contrast:epssScore", - "value": "0.11" + "value": "0.73" }, { "name": "contrast:epssPercentile", - "value": "95.49" + "value": "99.41" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -12900,31 +13596,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "EPSS 0.73 on a high-severity CVE - elevated real-world exploitation likelihood warrants a closer look." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-46589-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2023-46589", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8034-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-8034", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8034" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8034" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-46589. Latest available release is 10.1.57.", + "description": "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8034. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -12978,16 +13674,20 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.21" }, { "name": "contrast:epssPercentile", - "value": "84.59" + "value": "97.43" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -13006,35 +13706,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Moderate EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-55752-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-55752", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-17563-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-17563", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17563" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17563" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "description": "Relative Path Traversal vulnerability in Apache Tomcat.\n\nThe fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-55752. Latest available release is 10.1.57.", + "description": "When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-17563. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -13088,16 +13788,20 @@ }, { "name": "contrast:epssScore", - "value": "0.67" + "value": "0.11" }, { "name": "contrast:epssPercentile", - "value": "99.23" + "value": "95.49" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -13116,35 +13820,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.67); duration-only justification warrants review." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41284-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2026-41284", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-46589-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-46589", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-41284. Latest available release is 10.1.57.", + "description": "Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-46589. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -13198,16 +13902,20 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "55.38" + "value": "84.59" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -13226,35 +13934,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-10072-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2019-10072", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-55752-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-55752", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-10072. Latest available release is 10.1.57.", + "description": "Relative Path Traversal vulnerability in Apache Tomcat.\n\nThe fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-55752. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -13308,16 +14016,20 @@ }, { "name": "contrast:epssScore", - "value": "0.73" + "value": "0.67" }, { "name": "contrast:epssPercentile", - "value": "99.41" + "value": "99.23" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -13340,31 +14052,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.73); duration-only justification warrants review." + "value": "EPSS 0.67 on a high-severity CVE - elevated exploitation likelihood warrants confirmation." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43513-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2026-43513", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41284-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-41284", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43513. Latest available release is 10.1.57.", + "description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-41284. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -13418,16 +14130,20 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "38.72" + "value": "55.38" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -13446,35 +14162,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-25122-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2021-25122", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-10072-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-10072", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25122" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25122" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A\u0027s request.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-25122. Latest available release is 10.1.57.", + "description": "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-10072. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -13528,16 +14244,20 @@ }, { "name": "contrast:epssScore", - "value": "0.18" + "value": "0.73" }, { "name": "contrast:epssPercentile", - "value": "96.99" + "value": "99.41" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -13560,31 +14280,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "EPSS 0.73 on a high-severity CVE - elevated exploitation likelihood warrants confirmation." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-34750-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2024-34750", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43513-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-43513", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34750" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34750" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-34750. Latest available release is 10.1.57.", + "description": "Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43513. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -13638,16 +14358,20 @@ }, { "name": "contrast:epssScore", - "value": "0.05" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "91.02" + "value": "38.72" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -13666,35 +14390,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Very low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-48988-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-48988", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-25122-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-25122", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25122" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25122" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-48988. Latest available release is 10.1.57.", + "description": "When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A\u0027s request.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-25122. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -13748,16 +14472,20 @@ }, { "name": "contrast:epssScore", - "value": "0.57" + "value": "0.18" }, { "name": "contrast:epssPercentile", - "value": "99.0" + "value": "96.99" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -13776,35 +14504,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.57); duration-only justification warrants review." + "value": "Moderate EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-49125-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-49125", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-34750-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-34750", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34750" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34750" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-49125. Latest available release is 10.1.57.", + "description": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-34750. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -13858,16 +14586,20 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.05" }, { "name": "contrast:epssPercentile", - "value": "87.57" + "value": "91.02" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -13886,26 +14618,26 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-52434-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-52434", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-48988-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-48988", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" }, "score": 7.5, "severity": "high", @@ -13913,8 +14645,8 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\n\nThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 9.0.107, which fixes the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-52434. Latest available release is 10.1.57.", + "description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-48988. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -13968,16 +14700,20 @@ }, { "name": "contrast:epssScore", - "value": "0.02" + "value": "0.57" }, { "name": "contrast:epssPercentile", - "value": "78.35" + "value": "99.0" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -14000,31 +14736,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "EPSS 0.57 on a high-severity CVE - elevated exploitation likelihood warrants confirmation." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-42252-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2022-42252", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-49125-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-49125", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42252" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42252" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2022-42252. Latest available release is 10.1.57.", + "description": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-49125. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -14078,16 +14814,20 @@ }, { "name": "contrast:epssScore", - "value": "0.02" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "73.24" + "value": "87.57" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -14106,26 +14846,26 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-53506-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-53506", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-52434-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-52434", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" }, "score": 7.5, "severity": "high", @@ -14133,8 +14873,8 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-53506. Latest available release is 10.1.57.", + "description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\n\nThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 9.0.107, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-52434. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -14192,12 +14932,16 @@ }, { "name": "contrast:epssPercentile", - "value": "79.28" + "value": "78.35" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -14216,35 +14960,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-52520-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-52520", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-42252-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2022-42252", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42252" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42252" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-52520. Latest available release is 10.1.57.", + "description": "If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2022-42252. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -14302,12 +15046,16 @@ }, { "name": "contrast:epssPercentile", - "value": "79.97" + "value": "73.24" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -14326,26 +15074,26 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-31650-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-31650", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-53506-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-53506", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31650" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31650" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" }, "score": 7.5, "severity": "high", @@ -14353,8 +15101,8 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-31650. Latest available release is 10.1.57.", + "description": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-53506. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -14408,16 +15156,20 @@ }, { "name": "contrast:epssScore", - "value": "0.6" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "99.07" + "value": "79.28" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -14436,26 +15188,26 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.6); duration-only justification warrants review." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-24549-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2024-24549", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-52520-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-52520", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" }, "score": 7.5, "severity": "high", @@ -14463,8 +15215,8 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-24549. Latest available release is 10.1.57.", + "description": "For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-52520. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -14518,16 +15270,20 @@ }, { "name": "contrast:epssScore", - "value": "0.23" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "97.6" + "value": "79.97" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -14546,26 +15302,26 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.23; duration-only justification warrants review." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-44487-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2023-44487", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-31650-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-31650", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31650" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31650" }, "score": 7.5, "severity": "high", @@ -14573,8 +15329,8 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-44487. Latest available release is 10.1.57.", + "description": "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-31650. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -14628,14 +15384,18 @@ }, { "name": "contrast:epssScore", - "value": "1.0" + "value": "0.6" }, { "name": "contrast:epssPercentile", - "value": "100.0" + "value": "99.07" }, { "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", "value": "true" }, { @@ -14660,22 +15420,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed HTTP/2 Rapid Reset CVE with EPSS 1.0, waived purely on duration - should be manually confirmed given active exploitation." + "value": "EPSS 0.6 on a high-severity CVE - elevated exploitation likelihood warrants confirmation." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1336-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-1336", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-11996-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2020-11996", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11996" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11996" }, "score": 7.5, "severity": "high", @@ -14683,14 +15443,14 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1336. Latest available release is 10.1.57.", + "description": "A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-11996. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { @@ -14738,23 +15498,27 @@ }, { "name": "contrast:epssScore", - "value": "0.21" + "value": "0.27" }, { "name": "contrast:epssPercentile", - "value": "97.34" + "value": "97.88" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", "value": "11.0.24" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -14762,7 +15526,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -14770,31 +15534,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.21; duration-only justification warrants review." + "value": "High severity with zero CVE Shield coverage - no active backstop for this duration-based claim." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-46701-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-46701", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-24549-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-24549", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" }, - "score": 7.3, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Improper Handling of Case Sensitivity vulnerability in Apache Tomcat\u0027s GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-46701. Latest available release is 10.1.57.", + "description": "Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-24549. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -14848,16 +15612,20 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.23" }, { "name": "contrast:epssPercentile", - "value": "86.11" + "value": "97.6" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -14876,41 +15644,41 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Moderate EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12418-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2019-12418", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-24880-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-24880", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24880" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24880" }, - "score": 7.0, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-12418. Latest available release is 10.1.57.", + "description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-24880. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { @@ -14962,19 +15730,23 @@ }, { "name": "contrast:epssPercentile", - "value": "66.64" + "value": "42.18" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", "value": "11.0.24" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -14982,7 +15754,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -14990,31 +15762,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "High severity with zero CVE Shield coverage - no active backstop." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-25329-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2021-25329", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-44487-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-44487", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" }, - "score": 7.0, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-25329. Latest available release is 10.1.57.", + "description": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-44487. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -15068,15 +15840,19 @@ }, { "name": "contrast:epssScore", - "value": "0.09" + "value": "1.0" }, { "name": "contrast:epssPercentile", - "value": "95.09" + "value": "100.0" }, { "name": "contrast:cisaKev", - "value": "false" + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" }, { "name": "contrast:latestVersion", @@ -15100,31 +15876,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "CISA KEV-listed HTTP/2 Rapid Reset, EPSS 1.0 - actively exploited DoS; duration-only reasoning should be confirmed." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-9484-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2020-9484", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1336-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1336", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" }, - "score": 7.0, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter\u003d\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-9484. Latest available release is 10.1.57.", + "description": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1336. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -15178,16 +15954,20 @@ }, { "name": "contrast:epssScore", - "value": "0.57" + "value": "0.21" }, { "name": "contrast:epssPercentile", - "value": "98.99" + "value": "97.34" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -15206,41 +15986,41 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with elevated EPSS (0.57); duration-only justification warrants review." + "value": "Moderate EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1305-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-1305", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-42498-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-42498", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42498" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42498" }, - "score": 6.5, - "severity": "medium", + "score": 7.3, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], - "description": "Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1305. Latest available release is 10.1.57.", + "description": "Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-42498. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { @@ -15288,23 +16068,27 @@ }, { "name": "contrast:epssScore", - "value": "0.14" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "96.38" + "value": "46.41" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", "value": "11.0.24" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -15312,39 +16096,39 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "High severity with zero CVE Shield coverage - no active backstop." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0221-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2019-0221", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-46701-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-46701", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" }, - "score": 6.1, - "severity": "medium", + "score": 7.3, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], - "description": "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0221. Latest available release is 10.1.57.", + "description": "Improper Handling of Case Sensitivity vulnerability in Apache Tomcat\u0027s GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-46701. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -15398,16 +16182,20 @@ }, { "name": "contrast:epssScore", - "value": "0.46" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "98.71" + "value": "86.11" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -15430,31 +16218,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes despite EPSS 0.46." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-24122-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2021-24122", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12418-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-12418", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" }, - "score": 5.9, - "severity": "medium", + "score": 7.0, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-24122. Latest available release is 10.1.57.", + "description": "When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-12418. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -15508,16 +16296,20 @@ }, { "name": "contrast:epssScore", - "value": "0.23" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "97.58" + "value": "66.64" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -15540,31 +16332,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8037-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-8037", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-25329-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-25329", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" }, - "score": 5.9, - "severity": "medium", + "score": 7.0, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8037. Latest available release is 10.1.57.", + "description": "The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-25329. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -15618,16 +16410,20 @@ }, { "name": "contrast:epssScore", - "value": "0.11" + "value": "0.09" }, { "name": "contrast:epssPercentile", - "value": "95.67" + "value": "95.09" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -15650,31 +16446,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1304-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-1304", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-9484-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2020-9484", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" }, - "score": 5.9, - "severity": "medium", + "score": 7.0, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1304. Latest available release is 10.1.57.", + "description": "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter\u003d\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-9484. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -15728,16 +16524,20 @@ }, { "name": "contrast:epssScore", - "value": "0.17" + "value": "0.57" }, { "name": "contrast:epssPercentile", - "value": "96.86" + "value": "98.99" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -15756,35 +16556,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "EPSS 0.57 on a high-severity CVE - elevated exploitation likelihood warrants confirmation." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-61795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-61795", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1305-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1305", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" }, - "score": 5.3, + "score": 6.5, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-61795. Latest available release is 10.1.57.", + "description": "Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1305. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -15838,16 +16638,20 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.14" }, { "name": "contrast:epssPercentile", - "value": "65.15" + "value": "96.38" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -15870,37 +16674,37 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-21733-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2024-21733", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-41080-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-41080", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41080" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41080" }, - "score": 5.3, + "score": 6.1, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "description": "Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-21733. Latest available release is 10.1.57.", + "description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.\n\nThe vulnerability is limited to the ROOT (default) web application.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-41080. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { @@ -15948,23 +16752,27 @@ }, { "name": "contrast:epssScore", - "value": "0.14" + "value": "0.06" }, { "name": "contrast:epssPercentile", - "value": "96.34" + "value": "92.87" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", "value": "11.0.24" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -15972,7 +16780,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -15980,31 +16788,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity with no Shield coverage - lower stakes given severity." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-42795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2023-42795", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0221-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-0221", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" }, - "score": 5.3, + "score": 6.1, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "description": "Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could \ncause Tomcat to skip some parts of the recycling process leading to \ninformation leaking from the current request/response to the next.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-42795. Latest available release is 10.1.57.", + "description": "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0221. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -16058,16 +16866,20 @@ }, { "name": "contrast:epssScore", - "value": "0.02" + "value": "0.46" }, { "name": "contrast:epssPercentile", - "value": "80.95" + "value": "98.71" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -16090,31 +16902,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes despite moderate EPSS." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11784-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-11784", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-24122-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-24122", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" }, - "score": 4.3, + "score": 5.9, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to \u0027/foo/\u0027 when the user requested \u0027/foo\u0027) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-11784. Latest available release is 10.1.57.", + "description": "When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-24122. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -16168,16 +16980,20 @@ }, { "name": "contrast:epssScore", - "value": "0.94" + "value": "0.23" }, { "name": "contrast:epssPercentile", - "value": "99.85" + "value": "97.58" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "11.0.24" @@ -16200,46 +17016,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes despite high EPSS (0.94)." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-1000487-faba5d28a07fcde50c8c26d3f002774acf11843e", - "id": "CVE-2017-1000487", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8037-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-8037", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" }, - "score": 9.8, - "severity": "critical", + "score": 5.9, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.", - "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2017-1000487. Latest available release is 3.6.1.", + "description": "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8037. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", "versions": [ { - "version": "3.0.8", + "version": "8.5.15", "status": "affected" }, { - "version": "4.0.3", + "version": "9.0.118", "status": "unaffected" } ] @@ -16256,11 +17074,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "387" }, { "name": "contrast:classCount", - "value": "102" + "value": "1481" }, { "name": "contrast:daysObserved", @@ -16276,19 +17094,23 @@ }, { "name": "contrast:epssScore", - "value": "0.06" + "value": "0.11" }, { "name": "contrast:epssPercentile", - "value": "93.28" + "value": "95.67" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "4.0.3" + "value": "11.0.24" }, { "name": "contrast:devStatus", @@ -16308,46 +17130,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 102 classes loaded - structural fact regardless of critical severity." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-67030-faba5d28a07fcde50c8c26d3f002774acf11843e", - "id": "CVE-2025-67030", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1304-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1304", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" }, - "score": 8.8, - "severity": "high", + "score": 5.9, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code", - "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2025-67030. Latest available release is 3.6.1.", + "description": "The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1304. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", "versions": [ { - "version": "3.0.8", + "version": "8.5.15", "status": "affected" }, { - "version": "4.0.3", + "version": "9.0.118", "status": "unaffected" } ] @@ -16364,11 +17188,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "387" }, { "name": "contrast:classCount", - "value": "102" + "value": "1481" }, { "name": "contrast:daysObserved", @@ -16384,19 +17208,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.17" }, { "name": "contrast:epssPercentile", - "value": "49.29" + "value": "96.86" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "4.0.3" + "value": "11.0.24" }, { "name": "contrast:devStatus", @@ -16416,46 +17244,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds even for high severity." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4244-faba5d28a07fcde50c8c26d3f002774acf11843e", - "id": "CVE-2022-4244", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-61795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-61795", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" }, - "score": 7.5, - "severity": "high", + "score": 5.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.", - "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4244. Latest available release is 3.6.1.", + "description": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-61795. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", "versions": [ { - "version": "3.0.8", + "version": "8.5.15", "status": "affected" }, { - "version": "4.0.3", + "version": "9.0.118", "status": "unaffected" } ] @@ -16472,11 +17302,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "387" }, { "name": "contrast:classCount", - "value": "102" + "value": "1481" }, { "name": "contrast:daysObserved", @@ -16496,15 +17326,19 @@ }, { "name": "contrast:epssPercentile", - "value": "69.52" + "value": "65.15" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "4.0.3" + "value": "11.0.24" }, { "name": "contrast:devStatus", @@ -16524,46 +17358,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4245-faba5d28a07fcde50c8c26d3f002774acf11843e", - "id": "CVE-2022-4245", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-21733-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-21733", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" }, - "score": 4.3, + "score": 5.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], - "description": "A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --\u003e sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.", - "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4245. Latest available release is 3.6.1.", + "description": "Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-21733. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", "versions": [ { - "version": "3.0.8", + "version": "8.5.15", "status": "affected" }, { - "version": "4.0.3", + "version": "9.0.118", "status": "unaffected" } ] @@ -16580,11 +17416,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "387" }, { "name": "contrast:classCount", - "value": "102" + "value": "1481" }, { "name": "contrast:daysObserved", @@ -16600,19 +17436,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.14" }, { "name": "contrast:epssPercentile", - "value": "50.52" + "value": "96.34" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "4.0.3" + "value": "11.0.24" }, { "name": "contrast:devStatus", @@ -16632,46 +17472,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20445-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2019-20445", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-42795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-42795", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" }, - "score": 9.1, - "severity": "critical", + "score": 5.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], - "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20445.", + "description": "Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could \ncause Tomcat to skip some parts of the recycling process leading to \ninformation leaking from the current request/response to the next.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-42795. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", "versions": [ { - "version": "3.5.7.Final", + "version": "8.5.15", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "9.0.118", "status": "unaffected" } ] @@ -16688,11 +17530,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "387" }, { "name": "contrast:classCount", - "value": "727" + "value": "1481" }, { "name": "contrast:daysObserved", @@ -16708,19 +17550,23 @@ }, { "name": "contrast:epssScore", - "value": "0.13" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "96.17" + "value": "80.95" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "11.0.24" }, { "name": "contrast:devStatus", @@ -16740,46 +17586,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 727 classes loaded - structural fact regardless of critical severity." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20444-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2019-20444", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-45648-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-45648", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45648" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45648" }, - "score": 9.1, - "severity": "critical", + "score": 5.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], - "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\"", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20444.", + "description": "Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially \ncrafted, invalid trailer header could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-45648. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", "versions": [ { - "version": "3.5.7.Final", + "version": "8.5.15", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "9.0.118", "status": "unaffected" } ] @@ -16796,11 +17644,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "387" }, { "name": "contrast:classCount", - "value": "727" + "value": "1481" }, { "name": "contrast:daysObserved", @@ -16816,23 +17664,27 @@ }, { "name": "contrast:epssScore", - "value": "0.09" + "value": "0.06" }, { "name": "contrast:epssPercentile", - "value": "94.87" + "value": "92.66" }, { "name": "contrast:cisaKev", "value": "false" }, { - "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "name": "contrast:shieldAvailable", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -16840,7 +17692,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -16848,46 +17700,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "Medium severity with no Shield coverage - lower stakes given severity." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37136-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-37136", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-1935-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2020-1935", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1935" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1935" }, - "score": 7.5, - "severity": "high", + "score": 4.8, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], - "description": "The Bzip2 decompression decoder function doesn\u0027t allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37136.", + "description": "In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-1935. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", "versions": [ { - "version": "3.5.7.Final", + "version": "8.5.15", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "9.0.118", "status": "unaffected" } ] @@ -16904,11 +17758,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "387" }, { "name": "contrast:classCount", - "value": "727" + "value": "1481" }, { "name": "contrast:daysObserved", @@ -16924,23 +17778,27 @@ }, { "name": "contrast:epssScore", - "value": "0.06" + "value": "0.09" }, { "name": "contrast:epssPercentile", - "value": "92.72" + "value": "95.05" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "11.0.24" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -16948,7 +17806,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -16956,46 +17814,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "Medium severity with no Shield coverage - lower stakes given severity." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37137-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-37137", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11784-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-11784", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" }, - "score": 7.5, - "severity": "high", + "score": 4.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], - "description": "The Snappy frame decoder function doesn\u0027t restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37137.", + "description": "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to \u0027/foo/\u0027 when the user requested \u0027/foo\u0027) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-11784. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", "versions": [ { - "version": "3.5.7.Final", + "version": "8.5.15", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "9.0.118", "status": "unaffected" } ] @@ -17012,11 +17872,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "387" }, { "name": "contrast:classCount", - "value": "727" + "value": "1481" }, { "name": "contrast:daysObserved", @@ -17032,19 +17892,23 @@ }, { "name": "contrast:epssScore", - "value": "0.07" + "value": "0.94" }, { "name": "contrast:epssPercentile", - "value": "93.5" + "value": "99.85" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "11.0.24" }, { "name": "contrast:devStatus", @@ -17064,46 +17928,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "Medium severity (4.3) - lower stakes despite high EPSS, per severity-based risk tiering." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16869-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2019-16869", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43514-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-43514", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43514" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43514" }, - "score": 7.5, - "severity": "high", + "score": 3.7, + "severity": "low", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], - "description": "Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-16869.", + "description": "Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43514. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", "versions": [ { - "version": "3.5.7.Final", + "version": "8.5.15", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "9.0.118", "status": "unaffected" } ] @@ -17120,11 +17986,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "387" }, { "name": "contrast:classCount", - "value": "727" + "value": "1481" }, { "name": "contrast:daysObserved", @@ -17140,23 +18006,27 @@ }, { "name": "contrast:epssScore", - "value": "0.08" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "94.6" + "value": "28.04" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "11.0.24" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -17164,7 +18034,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -17172,46 +18042,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "Low severity - lower stakes even with no Shield coverage." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-43797-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-43797", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-1000487-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2017-1000487", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" }, - "score": 6.5, - "severity": "medium", + "score": 9.8, + "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. Netty prior to version 4.1.7.1.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to \"sanitize\" header names before it forward these to another remote system when used as proxy. This remote system can\u0027t see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.7.1.Final to receive a patch.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-43797.", + "description": "Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2017-1000487. Latest available release is 3.6.1.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", "versions": [ { - "version": "3.5.7.Final", + "version": "3.0.8", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "4.0.3", "status": "unaffected" } ] @@ -17232,7 +18102,7 @@ }, { "name": "contrast:classCount", - "value": "727" + "value": "102" }, { "name": "contrast:daysObserved", @@ -17248,19 +18118,23 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.06" }, { "name": "contrast:epssPercentile", - "value": "84.8" + "value": "93.28" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "4.0.3" }, { "name": "contrast:devStatus", @@ -17280,46 +18154,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21409-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-21409", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-67030-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2025-67030", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" }, - "score": 5.9, - "severity": "medium", + "score": 8.8, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21409.", + "description": "Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2025-67030. Latest available release is 3.6.1.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", "versions": [ { - "version": "3.5.7.Final", + "version": "3.0.8", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "4.0.3", "status": "unaffected" } ] @@ -17340,7 +18214,7 @@ }, { "name": "contrast:classCount", - "value": "727" + "value": "102" }, { "name": "contrast:daysObserved", @@ -17356,19 +18230,23 @@ }, { "name": "contrast:epssScore", - "value": "0.05" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "91.54" + "value": "49.29" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "4.0.3" }, { "name": "contrast:devStatus", @@ -17388,46 +18266,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21295-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-21295", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4244-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2022-4244", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" }, - "score": 5.9, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel\u0027s pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21295.", + "description": "A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4244. Latest available release is 3.6.1.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", "versions": [ { - "version": "3.5.7.Final", + "version": "3.0.8", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "4.0.3", "status": "unaffected" } ] @@ -17448,7 +18326,7 @@ }, { "name": "contrast:classCount", - "value": "727" + "value": "102" }, { "name": "contrast:daysObserved", @@ -17464,19 +18342,23 @@ }, { "name": "contrast:epssScore", - "value": "0.19" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "97.09" + "value": "69.52" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "4.0.3" }, { "name": "contrast:devStatus", @@ -17496,46 +18378,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21290-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-21290", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4245-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2022-4245", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" }, - "score": 5.5, + "score": 4.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], - "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty\u0027s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method \"File.createTempFile\" on unix-like systems creates a random file, but, by default will create this file with the permissions \"-rw-r--r--\". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty\u0027s \"AbstractDiskHttpData\" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own \"java.io.tmpdir\" when you start the JVM or use \"DefaultHttpDataFactory.setBaseDir(...)\" to set the directory to something that is only readable by the current user.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21290.", + "description": "A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --\u003e sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4245. Latest available release is 3.6.1.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", "versions": [ { - "version": "3.5.7.Final", + "version": "3.0.8", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "4.0.3", "status": "unaffected" } ] @@ -17556,7 +18438,7 @@ }, { "name": "contrast:classCount", - "value": "727" + "value": "102" }, { "name": "contrast:daysObserved", @@ -17572,19 +18454,23 @@ }, { "name": "contrast:epssScore", - "value": "0.02" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "76.68" + "value": "50.52" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "4.0.3" }, { "name": "contrast:devStatus", @@ -17604,29 +18490,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2015-2156-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2015-2156", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20445-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-20445", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" }, - "score": 0.0, - "method": "CVSSv31" + "score": 9.1, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2015-2156.", + "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20445.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", @@ -17678,16 +18566,20 @@ }, { "name": "contrast:epssScore", - "value": "0.05" + "value": "0.13" }, { "name": "contrast:epssPercentile", - "value": "91.94" + "value": "96.17" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "3.10.6.Final" @@ -17710,22 +18602,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-2332-c51b8a6a67d64672889249dd958edd77bff8fc0c", - "id": "CVE-2026-2332", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20444-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-20444", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" }, "score": 9.1, "severity": "critical", @@ -17733,23 +18625,23 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n * https://w4ke.info/2025/06/18/funky-chunks.html\n\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext\u003d\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.", - "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2026-2332. Latest available release is 12.0.34.", + "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\"", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20444.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "9.4.5.v20170502", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "12.1.7", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -17770,7 +18662,7 @@ }, { "name": "contrast:classCount", - "value": "81" + "value": "727" }, { "name": "contrast:daysObserved", @@ -17786,19 +18678,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.09" }, { "name": "contrast:epssPercentile", - "value": "68.57" + "value": "94.87" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "12.1.11" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", @@ -17818,46 +18714,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 81 classes loaded - structural fact regardless of critical severity." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-11143-c51b8a6a67d64672889249dd958edd77bff8fc0c", - "id": "CVE-2025-11143", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37136-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-37136", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" }, - "score": 6.5, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.", - "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2025-11143. Latest available release is 12.0.34.", + "description": "The Bzip2 decompression decoder function doesn\u0027t allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37136.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "9.4.5.v20170502", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "12.1.7", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -17878,7 +18774,7 @@ }, { "name": "contrast:classCount", - "value": "81" + "value": "727" }, { "name": "contrast:daysObserved", @@ -17894,23 +18790,27 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.06" }, { "name": "contrast:epssPercentile", - "value": "5.32" + "value": "92.72" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "12.1.11" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", - "value": "" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -17918,7 +18818,7 @@ }, { "name": "contrast:prodStatus", - "value": "" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -17926,46 +18826,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-6763-c51b8a6a67d64672889249dd958edd77bff8fc0c", - "id": "CVE-2024-6763", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37137-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-37137", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" }, - "score": 5.3, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC. Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.", - "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2024-6763. Latest available release is 12.0.34.", + "description": "The Snappy frame decoder function doesn\u0027t restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37137.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "9.4.5.v20170502", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "12.1.7", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -17986,7 +18886,7 @@ }, { "name": "contrast:classCount", - "value": "81" + "value": "727" }, { "name": "contrast:daysObserved", @@ -18002,19 +18902,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.07" }, { "name": "contrast:epssPercentile", - "value": "59.31" + "value": "93.5" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "12.1.11" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", @@ -18034,46 +18938,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-40167-c51b8a6a67d64672889249dd958edd77bff8fc0c", - "id": "CVE-2023-40167", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16869-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-16869", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" }, - "score": 5.3, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.", - "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2023-40167. Latest available release is 12.0.34.", + "description": "Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-16869.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "9.4.5.v20170502", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "12.1.7", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -18094,7 +18998,7 @@ }, { "name": "contrast:classCount", - "value": "81" + "value": "727" }, { "name": "contrast:daysObserved", @@ -18110,19 +19014,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.08" }, { "name": "contrast:epssPercentile", - "value": "62.52" + "value": "94.6" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "12.1.11" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", @@ -18142,46 +19050,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-2047-c51b8a6a67d64672889249dd958edd77bff8fc0c", - "id": "CVE-2022-2047", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-43797-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-43797", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" }, - "score": 2.7, - "severity": "low", + "score": 6.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], - "description": "In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.", - "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2022-2047. Latest available release is 12.0.34.", + "description": "Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. Netty prior to version 4.1.7.1.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to \"sanitize\" header names before it forward these to another remote system when used as proxy. This remote system can\u0027t see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.7.1.Final to receive a patch.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-43797.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "9.4.5.v20170502", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "12.1.7", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -18202,7 +19110,7 @@ }, { "name": "contrast:classCount", - "value": "81" + "value": "727" }, { "name": "contrast:daysObserved", @@ -18218,19 +19126,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "67.39" + "value": "84.8" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "12.1.11" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", @@ -18250,48 +19162,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41901-5101df9798ac08865717dd0bf6860504cd3bd758", - "id": "CVE-2026-41901", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21409-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21409", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" }, - "score": 9.0, - "severity": "critical", + "score": 5.9, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.", - "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-41901.", + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21409.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "3.0.6.RELEASE", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "3.1.3.RELEASE", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -18308,11 +19218,1475 @@ }, { "name": "contrast:classesUsed", - "value": "367" + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.54" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable - structural fact." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21295-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21295", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel\u0027s pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21295.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.19" + }, + { + "name": "contrast:epssPercentile", + "value": "97.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable - structural fact." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21290-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21290", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty\u0027s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method \"File.createTempFile\" on unix-like systems creates a random file, but, by default will create this file with the permissions \"-rw-r--r--\". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty\u0027s \"AbstractDiskHttpData\" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own \"java.io.tmpdir\" when you start the JVM or use \"DefaultHttpDataFactory.setBaseDir(...)\" to set the directory to something that is only readable by the current user.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21290.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "76.68" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable - structural fact." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2015-2156-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2015-2156", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2015-2156.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable - structural fact." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-2332-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2026-2332", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" + }, + "score": 9.1, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n * https://w4ke.info/2025/06/18/funky-chunks.html\n\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext\u003d\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2026-2332. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "68.57" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable - structural fact." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-11143-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2025-11143", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "description": "The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2025-11143. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "5.32" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable - structural fact." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-6763-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2024-6763", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC. Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2024-6763. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "59.31" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable - structural fact." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-40167-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2023-40167", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2023-40167. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "62.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable - structural fact." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-2047-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2022-2047", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" + }, + "score": 2.7, + "severity": "low", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2022-2047. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.39" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "code_not_reachable - structural fact." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41901-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-41901", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" + }, + "score": 9.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-41901.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "versions": [ + { + "version": "3.0.6.RELEASE", + "status": "affected" + }, + { + "version": "3.1.3.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "367" + }, + { + "name": "contrast:classCount", + "value": "549" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "35.65" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.1.3.RELEASE" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Very low EPSS despite critical severity, Shield backstop present." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40477-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-40477", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" + }, + "score": 9.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40477.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "versions": [ + { + "version": "3.0.6.RELEASE", + "status": "affected" + }, + { + "version": "3.1.3.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "367" + }, + { + "name": "contrast:classCount", + "value": "549" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "55.73" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.1.3.RELEASE" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Very low EPSS, Shield backstop present." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40478-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-40478", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" + }, + "score": 9.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40478.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "versions": [ + { + "version": "3.0.6.RELEASE", + "status": "affected" + }, + { + "version": "3.1.3.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "367" + }, + { + "name": "contrast:classCount", + "value": "549" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "56.16" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.1.3.RELEASE" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Very low EPSS, Shield backstop present." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-3258-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2018-3258", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" + }, + "score": 8.8, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2018-3258.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "versions": [ + { + "version": "5.1.42", + "status": "affected" + }, + { + "version": "8.0.33", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "4" + }, + { + "name": "contrast:classCount", + "value": "347" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.33" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Low EPSS, Shield backstop present." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-22102-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2023-22102", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" + }, + "score": 8.3, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2023-22102.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "versions": [ + { + "version": "5.1.42", + "status": "affected" + }, + { + "version": "8.0.33", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "4" }, { "name": "contrast:classCount", - "value": "549" + "value": "347" }, { "name": "contrast:daysObserved", @@ -18328,19 +20702,23 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "35.65" + "value": "56.43" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "3.1.3.RELEASE" + "value": "8.0.33" }, { "name": "contrast:devStatus", @@ -18356,52 +20734,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity thymeleaf CVE, duration-only justification despite 367 of 549 classes actively loaded." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40477-5101df9798ac08865717dd0bf6860504cd3bd758", - "id": "CVE-2026-40477", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-2692-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2019-2692", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" }, - "score": 9.0, - "severity": "critical", + "score": 6.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + "vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" } ], - "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", - "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40477.", + "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2019-2692.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", "versions": [ { - "version": "3.0.6.RELEASE", + "version": "5.1.42", "status": "affected" }, { - "version": "3.1.3.RELEASE", + "version": "8.0.33", "status": "unaffected" } ] @@ -18418,11 +20796,11 @@ }, { "name": "contrast:classesUsed", - "value": "367" + "value": "4" }, { "name": "contrast:classCount", - "value": "549" + "value": "347" }, { "name": "contrast:daysObserved", @@ -18442,15 +20820,19 @@ }, { "name": "contrast:epssPercentile", - "value": "55.73" + "value": "40.94" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "3.1.3.RELEASE" + "value": "8.0.33" }, { "name": "contrast:devStatus", @@ -18466,52 +20848,50 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40478-5101df9798ac08865717dd0bf6860504cd3bd758", - "id": "CVE-2026-40478", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-21363-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2022-21363", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" }, - "score": 9.0, - "severity": "critical", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + "score": 0.0, + "method": "CVSSv31" } ], - "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", - "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40478.", + "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2022-21363.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", "versions": [ { - "version": "3.0.6.RELEASE", + "version": "5.1.42", "status": "affected" }, { - "version": "3.1.3.RELEASE", + "version": "8.0.33", "status": "unaffected" } ] @@ -18528,11 +20908,11 @@ }, { "name": "contrast:classesUsed", - "value": "367" + "value": "4" }, { "name": "contrast:classCount", - "value": "549" + "value": "347" }, { "name": "contrast:daysObserved", @@ -18552,15 +20932,131 @@ }, { "name": "contrast:epssPercentile", - "value": "56.16" + "value": "68.89" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.33" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "No severity score assigned, low stakes." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-22733-10f526d22f58a32a8c3af26ccb0a6f16f4649935", + "id": "CVE-2026-22733", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.", + "recommendation": "Upgrade spring-boot-starter-actuator from 1.5.4.RELEASE to 3.5.12 to remediate CVE-2026-22733. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.5.12", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "28.97" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "3.1.3.RELEASE" + "value": "4.1.0" }, { "name": "contrast:devStatus", @@ -18576,52 +21072,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, duration-only justification." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-3258-80a448a3ec2178b649bb2e3cb3610fab06e11669", - "id": "CVE-2018-3258", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-27772-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2022-27772", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" }, - "score": 8.8, + "score": 7.8, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", - "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2018-3258.", + "description": "** UNSUPPORTED WHEN ASSIGNED ** spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2022-27772. Latest available release is 4.1.0.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", "versions": [ { - "version": "5.1.42", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "8.0.33", + "version": "3.0.0", "status": "unaffected" } ] @@ -18638,11 +21134,11 @@ }, { "name": "contrast:classesUsed", - "value": "4" + "value": "183" }, { "name": "contrast:classCount", - "value": "347" + "value": "458" }, { "name": "contrast:daysObserved", @@ -18658,19 +21154,23 @@ }, { "name": "contrast:epssScore", - "value": "0.04" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "89.09" + "value": "46.27" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "8.0.33" + "value": "4.1.0" }, { "name": "contrast:devStatus", @@ -18686,52 +21186,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity mysql-connector-java CVE, duration-only justification." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-22102-80a448a3ec2178b649bb2e3cb3610fab06e11669", - "id": "CVE-2023-22102", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-22235-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2025-22235", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" }, - "score": 8.3, + "score": 7.3, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], - "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", - "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2023-22102.", + "description": "EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.\n\nYour application may be affected by this if all the following conditions are met:\n\n * You use Spring Security\n * EndpointRequest.to() has been used in a Spring Security chain configuration\n * The endpoint which EndpointRequest references is disabled or not exposed via web\n * Your application handles requests to /null and this path needs protection\n\n\nYou are not affected if any of the following is true:\n\n * You don\u0027t use Spring Security\n * You don\u0027t use EndpointRequest.to()\n * The endpoint which EndpointRequest.to() refers to is enabled and is exposed\n * Your application does not handle requests to /null or this path does not need protection", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2025-22235. Latest available release is 4.1.0.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", "versions": [ { - "version": "5.1.42", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "8.0.33", + "version": "3.0.0", "status": "unaffected" } ] @@ -18748,11 +21248,11 @@ }, { "name": "contrast:classesUsed", - "value": "4" + "value": "183" }, { "name": "contrast:classCount", - "value": "347" + "value": "458" }, { "name": "contrast:daysObserved", @@ -18768,19 +21268,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "56.43" + "value": "34.63" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "8.0.33" + "value": "4.1.0" }, { "name": "contrast:devStatus", @@ -18796,52 +21300,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Very low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-2692-80a448a3ec2178b649bb2e3cb3610fab06e11669", - "id": "CVE-2019-2692", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40973-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2026-40973", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" }, - "score": 6.3, - "severity": "medium", + "score": 7.0, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).", - "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2019-2692.", + "description": "A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2026-40973. Latest available release is 4.1.0.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", "versions": [ { - "version": "5.1.42", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "8.0.33", + "version": "3.0.0", "status": "unaffected" } ] @@ -18858,11 +21362,11 @@ }, { "name": "contrast:classesUsed", - "value": "4" + "value": "183" }, { "name": "contrast:classCount", - "value": "347" + "value": "458" }, { "name": "contrast:daysObserved", @@ -18878,19 +21382,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "40.94" + "value": "3.32" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "8.0.33" + "value": "4.1.0" }, { "name": "contrast:devStatus", @@ -18910,46 +21418,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Very low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-21363-80a448a3ec2178b649bb2e3cb3610fab06e11669", - "id": "CVE-2022-21363", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1196-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2018-1196", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" }, - "score": 0.0, - "method": "CVSSv31" + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).", - "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2022-21363.", + "description": "Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the \"run_user\" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the \"run_user\" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2018-1196. Latest available release is 4.1.0.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", "versions": [ { - "version": "5.1.42", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "8.0.33", + "version": "3.0.0", "status": "unaffected" } ] @@ -18966,11 +21476,11 @@ }, { "name": "contrast:classesUsed", - "value": "4" + "value": "183" }, { "name": "contrast:classCount", - "value": "347" + "value": "458" }, { "name": "contrast:daysObserved", @@ -18990,15 +21500,19 @@ }, { "name": "contrast:epssPercentile", - "value": "68.89" + "value": "66.4" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "8.0.33" + "value": "4.1.0" }, { "name": "contrast:devStatus", @@ -19018,46 +21532,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated; duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-22733-10f526d22f58a32a8c3af26ccb0a6f16f4649935", - "id": "CVE-2026-22733", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-28366-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", + "id": "CVE-2022-28366", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" }, - "score": 8.1, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.", - "recommendation": "Upgrade spring-boot-starter-actuator from 1.5.4.RELEASE to 3.5.12 to remediate CVE-2026-22733. Latest available release is 4.1.0.", + "description": "Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.", + "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-28366. Latest available release is 2.70.0.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@1.5.4.RELEASE", + "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "2.21", "status": "affected" }, { - "version": "3.5.12", + "version": "2.61.0", "status": "unaffected" } ] @@ -19078,7 +21592,7 @@ }, { "name": "contrast:classCount", - "value": "0" + "value": "53" }, { "name": "contrast:daysObserved", @@ -19094,23 +21608,27 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "28.97" + "value": "80.88" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "2.70.0" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -19118,7 +21636,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -19126,48 +21644,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 0 classes loaded - structural fact even for high severity." + "value": "code_not_reachable - structural fact, safe to rely on regardless of the missing Shield coverage." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-27772-0cf51bb0751c1362a417eb59824d27d2907780d2", - "id": "CVE-2022-27772", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-29546-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", + "id": "CVE-2022-29546", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" }, - "score": 7.8, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "** UNSUPPORTED WHEN ASSIGNED ** spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer.", - "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2022-27772. Latest available release is 4.1.0.", + "description": "HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.", + "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-29546. Latest available release is 2.70.0.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "2.21", "status": "affected" }, { - "version": "3.0.0", + "version": "2.61.0", "status": "unaffected" } ] @@ -19184,11 +21700,11 @@ }, { "name": "contrast:classesUsed", - "value": "183" + "value": "0" }, { "name": "contrast:classCount", - "value": "458" + "value": "53" }, { "name": "contrast:daysObserved", @@ -19208,15 +21724,19 @@ }, { "name": "contrast:epssPercentile", - "value": "46.27" + "value": "67.25" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "2.70.0" }, { "name": "contrast:devStatus", @@ -19232,52 +21752,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-boot CVE, duration-only justification." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-22235-0cf51bb0751c1362a417eb59824d27d2907780d2", - "id": "CVE-2025-22235", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-25647-c4ba5371a29ac9b2ad6129b1d39ea38750043eff", + "id": "CVE-2022-25647", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" }, - "score": 7.3, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } - ], - "description": "EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.\n\nYour application may be affected by this if all the following conditions are met:\n\n * You use Spring Security\n * EndpointRequest.to() has been used in a Spring Security chain configuration\n * The endpoint which EndpointRequest references is disabled or not exposed via web\n * Your application handles requests to /null and this path needs protection\n\n\nYou are not affected if any of the following is true:\n\n * You don\u0027t use Spring Security\n * You don\u0027t use EndpointRequest.to()\n * The endpoint which EndpointRequest.to() refers to is enabled and is exposed\n * Your application does not handle requests to /null or this path does not need protection", - "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2025-22235. Latest available release is 4.1.0.", + ], + "description": "The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.", + "recommendation": "Upgrade gson from 2.8.0 to 2.8.9 to remediate CVE-2022-25647. Latest available release is 2.12.1.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (36 of 174 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "ref": "pkg:maven/com.google.code.gson/gson@2.8.0", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "2.8.0", "status": "affected" }, { - "version": "3.0.0", + "version": "2.8.9", "status": "unaffected" } ] @@ -19294,11 +21814,11 @@ }, { "name": "contrast:classesUsed", - "value": "183" + "value": "36" }, { "name": "contrast:classCount", - "value": "458" + "value": "174" }, { "name": "contrast:daysObserved", @@ -19314,19 +21834,23 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.12" }, { "name": "contrast:epssPercentile", - "value": "34.63" + "value": "95.89" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "2.13.2" }, { "name": "contrast:devStatus", @@ -19342,52 +21866,50 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Moderate EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40973-0cf51bb0751c1362a417eb59824d27d2907780d2", - "id": "CVE-2026-40973", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-36090-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-36090", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" }, - "score": 7.0, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.", - "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2026-40973. Latest available release is 4.1.0.", + "description": "When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 zip package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-36090. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "1.9", "status": "affected" }, { - "version": "3.0.0", + "version": "1.26.0", "status": "unaffected" } ] @@ -19404,11 +21926,11 @@ }, { "name": "contrast:classesUsed", - "value": "183" + "value": "0" }, { "name": "contrast:classCount", - "value": "458" + "value": "200" }, { "name": "contrast:daysObserved", @@ -19424,19 +21946,23 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.13" }, { "name": "contrast:epssPercentile", - "value": "3.32" + "value": "96.04" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "1.28.0" }, { "name": "contrast:devStatus", @@ -19452,52 +21978,50 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1196-0cf51bb0751c1362a417eb59824d27d2907780d2", - "id": "CVE-2018-1196", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35516-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35516", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" }, - "score": 5.9, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the \"run_user\" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the \"run_user\" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.", - "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2018-1196. Latest available release is 4.1.0.", + "description": "When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35516. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "1.9", "status": "affected" }, { - "version": "3.0.0", + "version": "1.26.0", "status": "unaffected" } ] @@ -19514,11 +22038,11 @@ }, { "name": "contrast:classesUsed", - "value": "183" + "value": "0" }, { "name": "contrast:classCount", - "value": "458" + "value": "200" }, { "name": "contrast:daysObserved", @@ -19534,19 +22058,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.12" }, { "name": "contrast:epssPercentile", - "value": "66.4" + "value": "95.91" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "1.28.0" }, { "name": "contrast:devStatus", @@ -19566,22 +22094,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-28366-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", - "id": "CVE-2022-28366", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35517-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35517", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" }, "score": 7.5, "severity": "high", @@ -19589,23 +22117,23 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.", - "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-28366. Latest available release is 2.70.0.", + "description": "When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 tar package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35517. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", "versions": [ { - "version": "2.21", + "version": "1.9", "status": "affected" }, { - "version": "2.61.0", + "version": "1.26.0", "status": "unaffected" } ] @@ -19626,7 +22154,7 @@ }, { "name": "contrast:classCount", - "value": "53" + "value": "200" }, { "name": "contrast:daysObserved", @@ -19642,23 +22170,27 @@ }, { "name": "contrast:epssScore", - "value": "0.02" + "value": "0.11" }, { "name": "contrast:epssPercentile", - "value": "80.88" + "value": "95.47" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "2.70.0" + "value": "1.28.0" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -19666,7 +22198,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -19674,22 +22206,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 53 classes loaded - structural fact." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-29546-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", - "id": "CVE-2022-29546", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35515-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35515", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" }, "score": 7.5, "severity": "high", @@ -19697,23 +22229,23 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.", - "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-29546. Latest available release is 2.70.0.", + "description": "When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35515. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", "versions": [ { - "version": "2.21", + "version": "1.9", "status": "affected" }, { - "version": "2.61.0", + "version": "1.26.0", "status": "unaffected" } ] @@ -19734,7 +22266,7 @@ }, { "name": "contrast:classCount", - "value": "53" + "value": "200" }, { "name": "contrast:daysObserved", @@ -19750,19 +22282,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.12" }, { "name": "contrast:epssPercentile", - "value": "67.25" + "value": "95.73" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "2.70.0" + "value": "1.28.0" }, { "name": "contrast:devStatus", @@ -19782,48 +22318,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable - structural fact." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-25647-c4ba5371a29ac9b2ad6129b1d39ea38750043eff", - "id": "CVE-2022-25647", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-25710-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2024-25710", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" }, - "score": 7.5, - "severity": "high", + "score": 5.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], - "description": "The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.", - "recommendation": "Upgrade gson from 2.8.0 to 2.8.9 to remediate CVE-2022-25647. Latest available release is 2.12.1.", + "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.\n\nUsers are recommended to upgrade to version 1.26.0 which fixes the issue.\n\n", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2024-25710. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (36 of 174 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/com.google.code.gson/gson@2.8.0", + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", "versions": [ { - "version": "2.8.0", + "version": "1.9", "status": "affected" }, { - "version": "2.8.9", + "version": "1.26.0", "status": "unaffected" } ] @@ -19840,11 +22374,11 @@ }, { "name": "contrast:classesUsed", - "value": "36" + "value": "0" }, { "name": "contrast:classCount", - "value": "174" + "value": "200" }, { "name": "contrast:daysObserved", @@ -19860,19 +22394,23 @@ }, { "name": "contrast:epssScore", - "value": "0.12" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "95.89" + "value": "36.91" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "2.13.2" + "value": "1.28.0" }, { "name": "contrast:devStatus", @@ -19888,35 +22426,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity gson CVE with elevated EPSS (0.12); duration-only justification warrants review." + "value": "code_not_reachable, medium severity." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-36090-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2021-36090", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11771-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2018-11771", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" }, - "score": 7.5, - "severity": "high", + "score": 5.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], - "description": "When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 zip package.", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-36090. Latest available release is 1.28.0.", + "description": "When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17\u0027s ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress\u0027 zip package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2018-11771. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", @@ -19968,16 +22506,20 @@ }, { "name": "contrast:epssScore", - "value": "0.13" + "value": "0.05" }, { "name": "contrast:epssPercentile", - "value": "96.04" + "value": "91.97" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "1.28.0" @@ -20000,46 +22542,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 200 classes loaded - structural fact even for high severity." + "value": "code_not_reachable, medium severity." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35516-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2021-35516", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-34169-d55d3f02a56ec4c25695fe67e1334ff8c2ecea23", + "id": "CVE-2022-34169", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35516. Latest available release is 1.28.0.", + "description": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.", + "recommendation": "Upgrade xalan from 2.7.2 to 2.7.3 to remediate CVE-2022-34169.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (7 of 1501 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "ref": "pkg:maven/xalan/xalan@2.7.2", "versions": [ { - "version": "1.9", + "version": "2.7.2", "status": "affected" }, { - "version": "1.26.0", + "version": "2.7.3", "status": "unaffected" } ] @@ -20056,11 +22600,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "7" }, { "name": "contrast:classCount", - "value": "200" + "value": "1501" }, { "name": "contrast:daysObserved", @@ -20076,19 +22620,23 @@ }, { "name": "contrast:epssScore", - "value": "0.12" + "value": "0.81" }, { "name": "contrast:epssPercentile", - "value": "95.91" + "value": "99.6" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "1.28.0" + "value": "2.7.3" }, { "name": "contrast:devStatus", @@ -20104,50 +22652,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "EPSS 0.81 on a high-severity, actively-exploited-in-practice XSLT injection CVE relying only on 288-day duration-based reasoning - worth confirming despite minimal class usage (7/1501)." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35517-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2021-35517", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1272-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1272", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 tar package.", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35517. Latest available release is 1.28.0.", + "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1272. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", "versions": [ { - "version": "1.9", + "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "1.26.0", + "version": "5.2.19.RELEASE", "status": "unaffected" } ] @@ -20164,11 +22714,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "334" }, { "name": "contrast:classCount", - "value": "200" + "value": "791" }, { "name": "contrast:daysObserved", @@ -20184,19 +22734,23 @@ }, { "name": "contrast:epssScore", - "value": "0.11" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "95.47" + "value": "86.79" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "1.28.0" + "value": "7.0.8" }, { "name": "contrast:devStatus", @@ -20216,22 +22770,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35515-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2021-35515", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-15756-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-15756", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" }, "score": 7.5, "severity": "high", @@ -20239,23 +22793,25 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35515. Latest available release is 1.28.0.", + "description": "Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-15756. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", "versions": [ { - "version": "1.9", + "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "1.26.0", + "version": "5.2.19.RELEASE", "status": "unaffected" } ] @@ -20272,11 +22828,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "334" }, { "name": "contrast:classCount", - "value": "200" + "value": "791" }, { "name": "contrast:daysObserved", @@ -20292,19 +22848,23 @@ }, { "name": "contrast:epssScore", - "value": "0.12" + "value": "0.09" }, { "name": "contrast:epssPercentile", - "value": "95.73" + "value": "94.98" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "1.28.0" + "value": "7.0.8" }, { "name": "contrast:devStatus", @@ -20324,46 +22884,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-25710-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2024-25710", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41848-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2026-41848", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" }, - "score": 5.5, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.\n\nUsers are recommended to upgrade to version 1.26.0 which fixes the issue.\n\n", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2024-25710. Latest available release is 1.28.0.", + "description": "Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2026-41848. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", "versions": [ { - "version": "1.9", + "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "1.26.0", + "version": "5.2.19.RELEASE", "status": "unaffected" } ] @@ -20380,11 +22942,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "334" }, { "name": "contrast:classCount", - "value": "200" + "value": "791" }, { "name": "contrast:daysObserved", @@ -20404,15 +22966,19 @@ }, { "name": "contrast:epssPercentile", - "value": "36.91" + "value": "24.07" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "1.28.0" + "value": "7.0.8" }, { "name": "contrast:devStatus", @@ -20432,46 +22998,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "Very low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11771-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2018-11771", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11040-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-11040", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" }, - "score": 5.5, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17\u0027s ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress\u0027 zip package.", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2018-11771. Latest available release is 1.28.0.", + "description": "Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the \"jsonp\" and \"callback\" JSONP parameters, enabling cross-domain requests.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-11040. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", "versions": [ { - "version": "1.9", + "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "1.26.0", + "version": "5.2.19.RELEASE", "status": "unaffected" } ] @@ -20488,11 +23056,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "334" }, { "name": "contrast:classCount", - "value": "200" + "value": "791" }, { "name": "contrast:daysObserved", @@ -20508,19 +23076,23 @@ }, { "name": "contrast:epssScore", - "value": "0.05" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "91.97" + "value": "87.45" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "1.28.0" + "value": "7.0.8" }, { "name": "contrast:devStatus", @@ -20540,48 +23112,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-34169-d55d3f02a56ec4c25695fe67e1334ff8c2ecea23", - "id": "CVE-2022-34169", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1257-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1257", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" }, - "score": 7.5, - "severity": "high", + "score": 6.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.", - "recommendation": "Upgrade xalan from 2.7.2 to 2.7.3 to remediate CVE-2022-34169.", + "description": "Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1257. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (7 of 1501 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/xalan/xalan@2.7.2", + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", "versions": [ { - "version": "2.7.2", + "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "2.7.3", + "version": "5.2.19.RELEASE", "status": "unaffected" } ] @@ -20598,11 +23170,11 @@ }, { "name": "contrast:classesUsed", - "value": "7" + "value": "334" }, { "name": "contrast:classCount", - "value": "1501" + "value": "791" }, { "name": "contrast:daysObserved", @@ -20618,19 +23190,23 @@ }, { "name": "contrast:epssScore", - "value": "0.81" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "99.6" + "value": "87.42" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "2.7.3" + "value": "7.0.8" }, { "name": "contrast:devStatus", @@ -20646,35 +23222,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity xalan CVE with very high EPSS (0.81, 99.6 pct); duration-only justification is weak evidence for this exploitability profile despite minimal class usage (7 of 1501)." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1272-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-1272", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1271-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1271", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" }, - "score": 7.5, - "severity": "high", + "score": 5.9, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1272. Latest available release is 7.0.8.", + "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1271. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -20728,16 +23304,20 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.35" }, { "name": "contrast:epssPercentile", - "value": "86.79" + "value": "98.3" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -20756,35 +23336,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-core CVE, duration-only justification." + "value": "Medium severity, lower stakes despite moderate EPSS." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-15756-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-15756", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1199-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1199", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" }, - "score": 7.5, - "severity": "high", + "score": 5.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], - "description": "Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-15756. Latest available release is 7.0.8.", + "description": "Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1199. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -20838,16 +23418,20 @@ }, { "name": "contrast:epssScore", - "value": "0.09" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "94.98" + "value": "85.69" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -20866,35 +23450,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41848-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2026-41848", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-22096-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2021-22096", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" }, - "score": 7.5, - "severity": "high", + "score": 4.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], - "description": "Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2026-41848. Latest available release is 7.0.8.", + "description": "In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2021-22096. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -20948,16 +23532,20 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "24.07" + "value": "69.88" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -20976,52 +23564,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11040-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-11040", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41850-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41850", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the \"jsonp\" and \"callback\" JSONP parameters, enabling cross-domain requests.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-11040. Latest available release is 7.0.8.", + "description": "Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41850. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "versions": [ { "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.2.19.RELEASE", + "version": "5.3.39", "status": "unaffected" } ] @@ -21038,11 +23626,11 @@ }, { "name": "contrast:classesUsed", - "value": "334" + "value": "91" }, { "name": "contrast:classCount", - "value": "791" + "value": "142" }, { "name": "contrast:daysObserved", @@ -21058,16 +23646,20 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "87.45" + "value": "28.94" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -21086,52 +23678,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Very low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1257-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-1257", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41851-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41851", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" }, - "score": 6.5, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1257. Latest available release is 7.0.8.", + "description": "Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41851. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "versions": [ { "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.2.19.RELEASE", + "version": "5.3.39", "status": "unaffected" } ] @@ -21148,11 +23740,11 @@ }, { "name": "contrast:classesUsed", - "value": "334" + "value": "91" }, { "name": "contrast:classCount", - "value": "791" + "value": "142" }, { "name": "contrast:daysObserved", @@ -21168,16 +23760,20 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "87.42" + "value": "28.94" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -21200,48 +23796,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Very low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1271-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-1271", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41849-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41849", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" }, - "score": 5.9, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1271. Latest available release is 7.0.8.", + "description": "An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41849. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "versions": [ { "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.2.19.RELEASE", + "version": "5.3.39", "status": "unaffected" } ] @@ -21258,11 +23854,11 @@ }, { "name": "contrast:classesUsed", - "value": "334" + "value": "91" }, { "name": "contrast:classCount", - "value": "791" + "value": "142" }, { "name": "contrast:daysObserved", @@ -21278,16 +23874,20 @@ }, { "name": "contrast:epssScore", - "value": "0.35" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "98.3" + "value": "17.87" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -21310,48 +23910,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes despite EPSS 0.35." + "value": "Very low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1199-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-1199", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20863-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2023-20863", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" }, - "score": 5.3, + "score": 6.5, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1199. Latest available release is 7.0.8.", + "description": "In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20863. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "versions": [ { "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.2.19.RELEASE", + "version": "5.3.39", "status": "unaffected" } ] @@ -21368,11 +23968,11 @@ }, { "name": "contrast:classesUsed", - "value": "334" + "value": "91" }, { "name": "contrast:classCount", - "value": "791" + "value": "142" }, { "name": "contrast:daysObserved", @@ -21388,16 +23988,20 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "85.69" + "value": "63.96" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -21420,48 +24024,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-22096-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2021-22096", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20861-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2023-20861", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" }, - "score": 4.3, + "score": 6.5, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2021-22096. Latest available release is 7.0.8.", + "description": "In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20861. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "versions": [ { "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.2.19.RELEASE", + "version": "5.3.39", "status": "unaffected" } ] @@ -21478,11 +24082,11 @@ }, { "name": "contrast:classesUsed", - "value": "334" + "value": "91" }, { "name": "contrast:classCount", - "value": "791" + "value": "142" }, { "name": "contrast:daysObserved", @@ -21502,12 +24106,16 @@ }, { "name": "contrast:epssPercentile", - "value": "69.88" + "value": "59.52" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -21530,31 +24138,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41850-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2026-41850", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22950-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2022-22950", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" }, - "score": 7.5, - "severity": "high", + "score": 6.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41850. Latest available release is 7.0.8.", + "description": "n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2022-22950. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -21608,16 +24216,20 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.36" }, { "name": "contrast:epssPercentile", - "value": "28.94" + "value": "98.36" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -21636,35 +24248,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-expression CVE, duration-only justification." + "value": "Medium severity, lower stakes despite moderate EPSS." } ] }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41851-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2026-41851", + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41852-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41852", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" }, - "score": 7.5, - "severity": "high", + "score": 5.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], - "description": "Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41851. Latest available release is 7.0.8.", + "description": "A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41852. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -21722,12 +24334,16 @@ }, { "name": "contrast:epssPercentile", - "value": "28.94" + "value": "7.34" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -21746,35 +24362,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41849-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2026-41849", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38808-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2024-38808", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" }, - "score": 7.5, - "severity": "high", + "score": 4.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], - "description": "An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41849. Latest available release is 7.0.8.", + "description": "In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.\n\nSpecifically, an application is vulnerable when the following is true:\n\n * The application evaluates user-supplied SpEL expressions.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2024-38808. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -21828,16 +24444,20 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "17.87" + "value": "44.84" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -21856,52 +24476,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20863-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2023-20863", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20883-5591fa7358d950f374532c7d92dccf113ebfa1bb", + "id": "CVE-2023-20883", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" }, - "score": 6.5, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20863. Latest available release is 7.0.8.", + "description": "In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.", + "recommendation": "Upgrade spring-boot-autoconfigure from 1.5.4.RELEASE to 2.5.15 to remediate CVE-2023-20883. Latest available release is 4.1.0.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (195 of 848 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@1.5.4.RELEASE", "versions": [ { - "version": "4.3.9.RELEASE", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "5.3.39", + "version": "2.5.15", "status": "unaffected" } ] @@ -21918,11 +24538,11 @@ }, { "name": "contrast:classesUsed", - "value": "91" + "value": "195" }, { "name": "contrast:classCount", - "value": "142" + "value": "848" }, { "name": "contrast:daysObserved", @@ -21942,15 +24562,19 @@ }, { "name": "contrast:epssPercentile", - "value": "63.96" + "value": "57.6" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "7.0.8" + "value": "4.1.0" }, { "name": "contrast:devStatus", @@ -21970,48 +24594,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20861-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2023-20861", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-13935-a92b066b0ea9ee1cb05b7d5e4bfed4ad8898f741", + "id": "CVE-2020-13935", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13935" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13935" }, - "score": 6.5, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20861. Latest available release is 7.0.8.", + "description": "The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.", + "recommendation": "Upgrade tomcat-embed-websocket from 8.5.15 to 8.0.32 to remediate CVE-2020-13935. Latest available release is 10.1.4.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (25 of 168 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15", "versions": [ { - "version": "4.3.9.RELEASE", + "version": "8.5.15", "status": "affected" }, { - "version": "5.3.39", + "version": "8.0.32", "status": "unaffected" } ] @@ -22028,11 +24652,11 @@ }, { "name": "contrast:classesUsed", - "value": "91" + "value": "25" }, { "name": "contrast:classCount", - "value": "142" + "value": "168" }, { "name": "contrast:daysObserved", @@ -22048,23 +24672,27 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.87" }, { "name": "contrast:epssPercentile", - "value": "59.52" + "value": "99.72" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", - "value": "7.0.8" + "value": "11.0.24" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -22072,56 +24700,56 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "High severity, EPSS 0.87, and zero CVE Shield coverage in this environment scope - both the exploitation likelihood and absence of a backstop make this the weakest claim in the dataset." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22950-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2022-22950", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-23672-a92b066b0ea9ee1cb05b7d5e4bfed4ad8898f741", + "id": "CVE-2024-23672", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" }, - "score": 6.5, + "score": 6.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" } ], - "description": "n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2022-22950. Latest available release is 7.0.8.", + "description": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-websocket from 8.5.15 to 8.0.32 to remediate CVE-2024-23672. Latest available release is 10.1.4.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (25 of 168 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15", "versions": [ { - "version": "4.3.9.RELEASE", + "version": "8.5.15", "status": "affected" }, { - "version": "5.3.39", + "version": "8.0.32", "status": "unaffected" } ] @@ -22138,11 +24766,11 @@ }, { "name": "contrast:classesUsed", - "value": "91" + "value": "25" }, { "name": "contrast:classCount", - "value": "142" + "value": "168" }, { "name": "contrast:daysObserved", @@ -22158,19 +24786,23 @@ }, { "name": "contrast:epssScore", - "value": "0.36" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "98.36" + "value": "82.23" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "7.0.8" + "value": "11.0.24" }, { "name": "contrast:devStatus", @@ -22190,48 +24822,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes despite EPSS 0.36." + "value": "Medium severity, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41852-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2026-41852", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-25638-7e1217f0df943561766b715ffb6cb1d270f3b715", + "id": "CVE-2020-25638", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" }, - "score": 5.3, - "severity": "medium", + "score": 7.4, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41852. Latest available release is 7.0.8.", + "description": "A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.", + "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2020-25638. Latest available release is 5.4.33.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", "versions": [ { - "version": "4.3.9.RELEASE", + "version": "5.0.4.Final", "status": "affected" }, { - "version": "5.3.39", + "version": "5.5.6", "status": "unaffected" } ] @@ -22248,11 +24880,11 @@ }, { "name": "contrast:classesUsed", - "value": "91" + "value": "1563" }, { "name": "contrast:classCount", - "value": "142" + "value": "3787" }, { "name": "contrast:daysObserved", @@ -22268,19 +24900,23 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "7.34" + "value": "86.13" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "7.0.8" + "value": "7.2.5.Final" }, { "name": "contrast:devStatus", @@ -22300,48 +24936,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Low EPSS, Shield backstop present (library very heavily loaded at 1563/3787 classes, but the specific vulnerable path is unobserved with backstop in place)." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38808-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2024-38808", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14900-7e1217f0df943561766b715ffb6cb1d270f3b715", + "id": "CVE-2019-14900", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" }, - "score": 4.3, + "score": 6.5, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.\n\nSpecifically, an application is vulnerable when the following is true:\n\n * The application evaluates user-supplied SpEL expressions.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2024-38808. Latest available release is 7.0.8.", + "description": "A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.", + "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2019-14900. Latest available release is 5.4.33.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", "versions": [ { - "version": "4.3.9.RELEASE", + "version": "5.0.4.Final", "status": "affected" }, { - "version": "5.3.39", + "version": "5.5.6", "status": "unaffected" } ] @@ -22358,11 +24994,11 @@ }, { "name": "contrast:classesUsed", - "value": "91" + "value": "1563" }, { "name": "contrast:classCount", - "value": "142" + "value": "3787" }, { "name": "contrast:daysObserved", @@ -22378,19 +25014,23 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "44.84" + "value": "80.65" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "7.0.8" + "value": "7.2.5.Final" }, { "name": "contrast:devStatus", @@ -22410,48 +25050,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20883-5591fa7358d950f374532c7d92dccf113ebfa1bb", - "id": "CVE-2023-20883", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-35036-0622a9bcef2eed6d41b5b8e0662c36212009e375", + "id": "CVE-2025-35036", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35036" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35036" }, - "score": 7.5, + "score": 7.3, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], - "description": "In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.", - "recommendation": "Upgrade spring-boot-autoconfigure from 1.5.4.RELEASE to 2.5.15 to remediate CVE-2023-20883. Latest available release is 4.1.0.", + "description": "Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.", + "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2025-35036.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (195 of 848 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@1.5.4.RELEASE", + "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "5.3.5.Final", "status": "affected" }, { - "version": "2.5.15", + "version": "8.0.2.Final", "status": "unaffected" } ] @@ -22468,11 +25108,11 @@ }, { "name": "contrast:classesUsed", - "value": "195" + "value": "225" }, { "name": "contrast:classCount", - "value": "848" + "value": "459" }, { "name": "contrast:daysObserved", @@ -22492,19 +25132,23 @@ }, { "name": "contrast:epssPercentile", - "value": "57.6" + "value": "50.61" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "8.0.2.Final" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -22512,7 +25156,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -22520,48 +25164,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-boot-autoconfigure CVE, duration-only justification." + "value": "High severity with zero CVE Shield coverage in this environment scope - no active backstop for this duration-based claim." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-23672-a92b066b0ea9ee1cb05b7d5e4bfed4ad8898f741", - "id": "CVE-2024-23672", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-7536-0622a9bcef2eed6d41b5b8e0662c36212009e375", + "id": "CVE-2017-7536", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" }, - "score": 6.3, - "severity": "medium", + "score": 7.0, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-websocket from 8.5.15 to 8.0.32 to remediate CVE-2024-23672. Latest available release is 10.1.4.", + "description": "In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager\u0027s reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().", + "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2017-7536.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (25 of 168 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15", + "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", "versions": [ { - "version": "8.5.15", + "version": "5.3.5.Final", "status": "affected" }, { - "version": "8.0.32", + "version": "8.0.2.Final", "status": "unaffected" } ] @@ -22578,11 +25222,11 @@ }, { "name": "contrast:classesUsed", - "value": "25" + "value": "225" }, { "name": "contrast:classCount", - "value": "168" + "value": "459" }, { "name": "contrast:daysObserved", @@ -22598,19 +25242,23 @@ }, { "name": "contrast:epssScore", - "value": "0.02" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "82.23" + "value": "39.71" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "11.0.24" + "value": "8.0.2.Final" }, { "name": "contrast:devStatus", @@ -22630,48 +25278,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Very low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-25638-7e1217f0df943561766b715ffb6cb1d270f3b715", - "id": "CVE-2020-25638", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-1932-0622a9bcef2eed6d41b5b8e0662c36212009e375", + "id": "CVE-2023-1932", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1932" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1932" }, - "score": 7.4, - "severity": "high", + "score": 6.1, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "description": "A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.", - "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2020-25638. Latest available release is 5.4.33.", + "description": "A flaw was found in hibernate-validator\u0027s \u0027isValid\u0027 method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.", + "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2023-1932.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { - "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", + "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", "versions": [ { - "version": "5.0.4.Final", + "version": "5.3.5.Final", "status": "affected" }, { - "version": "5.5.6", + "version": "8.0.2.Final", "status": "unaffected" } ] @@ -22688,11 +25336,11 @@ }, { "name": "contrast:classesUsed", - "value": "1563" + "value": "225" }, { "name": "contrast:classCount", - "value": "3787" + "value": "459" }, { "name": "contrast:daysObserved", @@ -22708,23 +25356,27 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "86.13" + "value": "38.53" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", - "value": "7.2.5.Final" + "value": "8.0.2.Final" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -22732,56 +25384,56 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity hibernate-core CVE, duration-only justification with substantial library usage (1563 of 3787 classes)." + "value": "Medium severity with no Shield coverage - lower stakes given severity." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14900-7e1217f0df943561766b715ffb6cb1d270f3b715", - "id": "CVE-2019-14900", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-10693-0622a9bcef2eed6d41b5b8e0662c36212009e375", + "id": "CVE-2020-10693", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10693" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10693" }, - "score": 6.5, + "score": 5.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], - "description": "A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.", - "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2019-14900. Latest available release is 5.4.33.", + "description": "A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.", + "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2020-10693.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { - "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", + "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", "versions": [ { - "version": "5.0.4.Final", + "version": "5.3.5.Final", "status": "affected" }, { - "version": "5.5.6", + "version": "8.0.2.Final", "status": "unaffected" } ] @@ -22798,11 +25450,11 @@ }, { "name": "contrast:classesUsed", - "value": "1563" + "value": "225" }, { "name": "contrast:classCount", - "value": "3787" + "value": "459" }, { "name": "contrast:daysObserved", @@ -22822,19 +25474,23 @@ }, { "name": "contrast:epssPercentile", - "value": "80.65" + "value": "82.07" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", - "value": "7.2.5.Final" + "value": "8.0.2.Final" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -22842,7 +25498,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -22850,48 +25506,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity with no Shield coverage - lower stakes given severity." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-7536-0622a9bcef2eed6d41b5b8e0662c36212009e375", - "id": "CVE-2017-7536", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-2976-6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9", + "id": "CVE-2023-2976", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" }, - "score": 7.0, + "score": 7.1, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager\u0027s reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().", - "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2017-7536.", + "description": "Use of Java\u0027s default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.\n\nEven though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.\n\n", + "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2023-2976.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", + "ref": "pkg:maven/com.google.guava/guava@19.0", "versions": [ { - "version": "5.3.5.Final", + "version": "19.0", "status": "affected" }, { - "version": "8.0.2.Final", + "version": "33.6.0-jre", "status": "unaffected" } ] @@ -22908,11 +25564,11 @@ }, { "name": "contrast:classesUsed", - "value": "225" + "value": "5" }, { "name": "contrast:classCount", - "value": "459" + "value": "1717" }, { "name": "contrast:daysObserved", @@ -22932,15 +25588,19 @@ }, { "name": "contrast:epssPercentile", - "value": "39.71" + "value": "15.93" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", - "value": "8.0.2.Final" + "value": "33.6.0-jre" }, { "name": "contrast:devStatus", @@ -22956,41 +25616,41 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity hibernate-validator CVE, duration-only justification." + "value": "Very low EPSS, Shield backstop present." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-2976-6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9", - "id": "CVE-2023-2976", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-10237-6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9", + "id": "CVE-2018-10237", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237" }, - "score": 7.1, - "severity": "high", + "score": 5.9, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Use of Java\u0027s default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.\n\nEven though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.\n\n", - "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2023-2976.", + "description": "Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.", + "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2018-10237.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." }, "affects": [ { @@ -23038,23 +25698,27 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.05" }, { "name": "contrast:epssPercentile", - "value": "15.93" + "value": "91.8" }, { "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", "value": "33.6.0-jre" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -23062,15 +25726,15 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity guava CVE, duration-only justification." + "value": "Medium severity with no Shield coverage - lower stakes given severity." } ] }, @@ -23158,6 +25822,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "33.6.0-jre" @@ -23180,7 +25848,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, duration-only acceptance is low-stakes." + "value": "Low severity, lower stakes." } ] }, @@ -23266,6 +25934,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.12.2" @@ -23288,7 +25960,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated (0.0); duration-only acceptance is low-stakes despite EPSS 0.17." + "value": "No severity score assigned, Shield backstop present." } ] }, @@ -23374,6 +26046,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.12.2" @@ -23396,7 +26072,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated (0.0); duration-only acceptance is low-stakes despite EPSS 0.25." + "value": "No severity score assigned, Shield backstop present." } ] }, @@ -23484,6 +26160,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.12.2" @@ -23506,7 +26186,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -23594,6 +26274,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.12.2" @@ -23616,7 +26300,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -23704,6 +26388,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.1.0" @@ -23726,7 +26414,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -23812,6 +26500,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "5.3.7" @@ -23834,7 +26526,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 0 classes loaded - structural fact." + "value": "code_not_reachable, medium severity." } ] }, @@ -23920,6 +26612,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "5.3.7" @@ -23942,7 +26638,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable, medium severity." } ] }, @@ -24028,6 +26724,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "5.3.7" @@ -24050,7 +26750,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable, medium severity." } ] }, @@ -24136,6 +26836,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "5.3.7" @@ -24158,7 +26862,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds despite elevated EPSS (0.16)." + "value": "code_not_reachable, medium severity." } ] }, @@ -24244,6 +26948,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "5.3.7" @@ -24266,7 +26974,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable, medium severity." } ] }, @@ -24352,6 +27060,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "5.3.7" @@ -24374,7 +27086,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable, medium severity." } ] }, @@ -24460,6 +27172,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.13.2" @@ -24482,7 +27198,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 286 classes loaded - structural fact." + "value": "code_not_reachable, medium severity, junit is a test-only dependency." } ] }, @@ -24568,6 +27284,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.6" @@ -24590,7 +27310,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-lang3: code_not_reachable, 0 of 152 classes loaded - structural fact." + "value": "commons-lang3: code_not_reachable - structural fact." } ] }, @@ -24676,6 +27396,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "3.20.0" @@ -24698,7 +27422,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-lang3: code_not_reachable, 0 of 152 classes loaded - structural fact." + "value": "commons-lang3: code_not_reachable - structural fact." } ] }, @@ -24786,6 +27510,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.1.0" @@ -24808,7 +27536,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -24896,6 +27624,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.1.0" @@ -24918,7 +27650,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -25006,6 +27738,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -25028,7 +27764,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -25116,6 +27852,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -25138,7 +27878,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-context: medium severity, duration-only acceptance is low-stakes." + "value": "spring-context: medium severity, lower stakes." } ] }, @@ -25226,6 +27966,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "7.0.8" @@ -25248,7 +27992,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, duration-only acceptance is low-stakes." + "value": "Low severity, lower stakes." } ] }, @@ -25334,6 +28078,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "4.5.14" @@ -25356,7 +28104,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 466 classes loaded - structural fact." + "value": "code_not_reachable, medium severity." } ] }, @@ -25442,6 +28190,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, { "name": "contrast:latestVersion", "value": "2.22.0" @@ -25464,7 +28216,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, 0 of 110 classes loaded - structural fact." + "value": "code_not_reachable - structural fact, safe regardless of missing Shield coverage." } ] }, @@ -25550,6 +28302,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.0" @@ -25572,7 +28328,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable; structural non-reachability holds." + "value": "code_not_reachable, medium severity." } ] }, @@ -25660,6 +28416,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -25682,7 +28442,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity (4.0), duration-only acceptance is low-stakes." + "value": "Medium severity, lower stakes." } ] }, @@ -25768,6 +28528,10 @@ "name": "contrast:cisaKev", "value": "false" }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, { "name": "contrast:latestVersion", "value": "2.22.1" @@ -25790,7 +28554,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Severity unrated; duration-only acceptance is low-stakes." + "value": "No severity score assigned, low stakes." } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index bb620fa..4ac3164 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -39,14 +39,21 @@ public class VEXAdvisor { "is to judge whether relying on each claim, as stated, is reasonable given the CVE's severity/exploitability, " + "or whether it's the kind of claim a human reviewer should double-check before trusting it.\n\n" + "You're also given whether Assess (the module that produces the runtime evidence every claim rests on) and " + - "Protect (the classic HTTP-rule-based RASP module, distinct from CVE Shield) are enabled per environment " + - "for this application. Weigh this directly: a duration-based claim scoped to an environment where Assess " + - "itself has no data or is disabled isn't weak evidence, it's NO evidence - flag it regardless of severity. " + - "A claim in an environment where Protect is disabled has one less active mitigating control as a backstop " + - "if the absence-of-execution reasoning turns out wrong, which raises the stakes of getting it wrong.\n\n" + + "ADR (the classic HTTP-rule-based RASP module, formerly branded \"Protect\" - distinct from CVE Shield) " + + "are enabled per environment for this application, and whether CVE Shield itself has any coverage for " + + "each specific CVE in that environment scope. Weigh all of this directly: a duration-based claim scoped " + + "to an environment where Assess has no data or is disabled isn't weak evidence, it's NO evidence - flag " + + "it regardless of severity. A claim where CVE Shield has no coverage for that CVE at all is weaker still " + + "than one where Shield exists and simply hasn't fired - \"we haven't seen it\" means less when nothing " + + "was capable of catching it in the first place. A claim in an environment where ADR is disabled has one " + + "less active mitigating control as a backstop if the absence-of-execution reasoning turns out wrong, " + + "which raises the stakes of getting it wrong.\n\n" + "## What makes a claim worth flagging for review\n\n" + "- Any duration-based claim scoped to an environment where Assess has no data or is disabled - there is no " + "runtime evidence behind it at all, regardless of the CVE's severity.\n" + + "- A duration-based claim on a CRITICAL/HIGH severity CVE where CVE Shield has no coverage at all for that " + + "CVE - there's no possibility of an active backstop catching an exploit attempt, so the claim rests " + + "entirely on absence-of-execution.\n" + "- A `not_affected` claim justified only by \"N days without observed execution\" (not by code_not_reachable " + "or protected_at_runtime) on a CRITICAL/HIGH severity CVE, especially one with a high EPSS score or KEV " + "(known-exploited) status - absence of evidence is weaker evidence the more severe/exploitable the CVE is.\n" + @@ -56,7 +63,7 @@ public class VEXAdvisor { "## What's normally fine as-is\n\n" + "- `code_not_reachable` (zero classes of the library ever loaded) - this is a structural fact, not a " + "probabilistic one, regardless of severity.\n" + - "- `protected_at_runtime` (CVE Shield/Protect actively mitigating) - an active control, not an absence of " + + "- `protected_at_runtime` (CVE Shield actively mitigating) - an active control, not an absence of " + "evidence.\n" + "- Low/medium severity CVEs accepted on duration alone - lower stakes if the absence-of-evidence reasoning " + "turns out wrong.\n\n" + @@ -92,6 +99,7 @@ static class VexStatement { Double epssScore; Double epssPercentile; Boolean cisaKev; + Boolean shieldAvailable; long classesUsed; long classCount; long daysObserved; @@ -101,9 +109,9 @@ static class VexStatement { static class AppEntry { String name; List statements = new ArrayList<>(); - // "true"/"false"/"" (no agent ever seen in that environment) - see VEXGenerator.ProtectionStatus + // "true"/"false"/"" (no agent ever seen in that environment) - see VEXGenerator.ModuleStatus String assessEnabledDev, assessEnabledQa, assessEnabledProd; - String protectEnabledDev, protectEnabledQa, protectEnabledProd; + String adrEnabledDev, adrEnabledQa, adrEnabledProd; } private final Gson gson = new GsonBuilder().setPrettyPrinting().create(); @@ -252,6 +260,8 @@ private List parseVex(String path) throws IOException { s.epssPercentile = parseDouble(props.get("contrast:epssPercentile")); String cisaProp = props.get("contrast:cisaKev"); s.cisaKev = cisaProp != null ? Boolean.parseBoolean(cisaProp) : null; + String shieldProp = props.get("contrast:shieldAvailable"); + s.shieldAvailable = shieldProp != null && !shieldProp.isEmpty() ? Boolean.parseBoolean(shieldProp) : null; byApp.computeIfAbsent(appName, k -> { AppEntry e = new AppEntry(); @@ -271,9 +281,9 @@ private List parseVex(String path) throws IOException { entry.assessEnabledDev = props.get("contrast:assessEnabledDev"); entry.assessEnabledQa = props.get("contrast:assessEnabledQa"); entry.assessEnabledProd = props.get("contrast:assessEnabledProd"); - entry.protectEnabledDev = props.get("contrast:protectEnabledDev"); - entry.protectEnabledQa = props.get("contrast:protectEnabledQa"); - entry.protectEnabledProd = props.get("contrast:protectEnabledProd"); + entry.adrEnabledDev = props.get("contrast:adrEnabledDev"); + entry.adrEnabledQa = props.get("contrast:adrEnabledQa"); + entry.adrEnabledProd = props.get("contrast:adrEnabledProd"); } return new ArrayList<>(byApp.values()); @@ -329,8 +339,8 @@ private String formatAppForAi(AppEntry entry) { sb.append("Application: ").append(entry.name).append("\n\n"); sb.append("Assess (the module that produces the runtime evidence behind every claim below) enabled: ") .append(formatEnvFlags(entry.assessEnabledDev, entry.assessEnabledQa, entry.assessEnabledProd)).append("\n"); - sb.append("Protect enabled (classic RASP module, not CVE Shield - no separate enablement flag for that is available): ") - .append(formatEnvFlags(entry.protectEnabledDev, entry.protectEnabledQa, entry.protectEnabledProd)).append("\n\n"); + sb.append("ADR enabled (classic RASP module, formerly \"Protect\" - not CVE Shield): ") + .append(formatEnvFlags(entry.adrEnabledDev, entry.adrEnabledQa, entry.adrEnabledProd)).append("\n\n"); sb.append("VEX Claims:"); for (VexStatement s : entry.statements) { @@ -345,6 +355,10 @@ private String formatAppForAi(AppEntry entry) { if (s.cisaKev != null) { sb.append("CISA Known Exploited Vulnerabilities (KEV) catalog: ").append(s.cisaKev ? "YES" : "no").append("\n"); } + if (s.shieldAvailable != null) { + sb.append("CVE Shield available for this CVE in this environment scope: ") + .append(s.shieldAvailable ? "YES" : "NO - no virtual patch coverage at all").append("\n"); + } sb.append("Claimed state: ").append(s.state).append("\n"); if (s.justification != null) sb.append("Justification: ").append(s.justification).append("\n"); sb.append("Detail: ").append(s.detail != null ? s.detail : "(none)").append("\n"); @@ -510,7 +524,7 @@ private String generateReport(List appResults, List entrie sb.append("**Assessment Type:** VEX Claim Soundness Review\n\n---\n\n"); sb.append("## Summary\n\n"); sb.append("This report reviews VEX (Vulnerability Exploitability eXchange) claims generated from Contrast ") - .append("Security runtime library-usage and CVE Shield/Protect data. It does not re-derive whether a CVE ") + .append("Security runtime library-usage and CVE Shield data. It does not re-derive whether a CVE ") .append("exists - it judges whether each `not_affected`/`in_triage` claim is well-supported enough to rely ") .append("on as-is, or whether a human should look at it first.\n\n"); sb.append("**Coverage:** ").append(totalApps).append(" application(s), ").append(totalStatements) @@ -551,19 +565,24 @@ private String generateReport(List appResults, List entrie sb.append("\n### Legend\n\n"); sb.append("**VEX** - `NA` = not_affected, `IT` = in_triage\n\n"); + sb.append("**Shield** - whether CVE Shield could catch this specific CVE at all in the environment(s) ") + .append("considered: `Yes` (Shield exists there, even if it hasn't fired), `No` (no Shield coverage for ") + .append("this CVE at all - the claim rests entirely on absence-of-execution, with no possible active ") + .append("backstop), `-` (no signal either way).\n\n"); sb.append("**Rationale** - why the claim was made, with the day count for the two duration-based reasons:\n\n"); sb.append("| Rationale | Meaning |\n|-----------|---------|\n"); sb.append("| `Library Unused` | Library never loaded at runtime (0 classes) - structural, not time-based |\n"); - sb.append("| `CVE Shielded` | CVE Shield/Protect actively mitigating at runtime - an active control, not time-based |\n"); + sb.append("| `CVE Shielded` | CVE Shield actively mitigating at runtime - an active control, not time-based |\n"); sb.append("| `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold |\n"); sb.append("| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold |\n\n"); sb.append("Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth ") .append("a second look surface at the top - see the Key Findings above for which specific CVEs those are.\n\n"); sb.append("**Protection Status** (shown per app below) - Assess is the module that produces the runtime ") - .append("evidence every claim in this report rests on; Protect is the classic HTTP-rule-based RASP module. ") - .append("Neither is CVE Shield - CVE Shield is a separate, newer product that defends specific CVEs via a ") - .append("microsandbox rather than HTTP rules, and Contrast's API exposes no distinct enablement flag for it. ") - .append("CVE Shield's own per-CVE verdicts still show up per-claim above as the `CVE Shielded` rationale.\n"); + .append("evidence every claim in this report rests on; ADR (formerly branded \"Protect\") is the classic ") + .append("HTTP-rule-based RASP module. Neither is CVE Shield - CVE Shield is a separate product that defends ") + .append("specific CVEs via a microsandbox rather than HTTP rules. Its own coverage is the per-row **Shield** ") + .append("column above, sourced from the real per-app, per-environment NO_SHIELD/NOT_SEEN signal where ") + .append("available.\n"); sb.append("\n---\n\n## Application Detail\n\n"); @@ -583,8 +602,8 @@ private String generateReport(List appResults, List entrie if (entry != null) { sb.append("**Protection Status:** Assess (runtime evidence): ") .append(formatEnvFlags(entry.assessEnabledDev, entry.assessEnabledQa, entry.assessEnabledProd)) - .append(" · Protect (classic RASP, not CVE Shield): ") - .append(formatEnvFlags(entry.protectEnabledDev, entry.protectEnabledQa, entry.protectEnabledProd)) + .append(" · ADR (classic RASP, formerly \"Protect\" - not CVE Shield): ") + .append(formatEnvFlags(entry.adrEnabledDev, entry.adrEnabledQa, entry.adrEnabledProd)) .append("\n\n"); } sb.append(getString(r, "application_description", "No description available.")).append("\n\n"); @@ -604,11 +623,12 @@ private String generateReport(List appResults, List entrie return Double.compare(bScore, aScore); }); - sb.append("| CVE | Library | Score | VEX | Rationale |\n|-----|---------|-------|-----|-----------|\n"); + sb.append("| CVE | Library | Score | VEX | Shield | Rationale |\n|-----|---------|-------|-----|--------|-----------|\n"); for (VexStatement s : statements) { sb.append("| ").append(s.cveId).append(" | ").append(plainLibrary(s.purl)) .append(" | ").append(s.score != null ? s.score : "-").append(" | ") .append("in_triage".equals(s.state) ? "IT" : "NA").append(" | ") + .append(shieldLabel(s.shieldAvailable)).append(" | ") .append(rationaleWord(s)).append(" |\n"); } sb.append("\n"); @@ -619,7 +639,7 @@ private String generateReport(List appResults, List entrie sb.append("## Appendix: Methodology\n\n"); sb.append("VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and ") - .append("per-environment CVE Shield/Protect status - see `vex --help` for the exact decision policy. This ") + .append("per-environment CVE Shield status - see `vex --help` for the exact decision policy. This ") .append("advisor does not change any claim; it only assesses whether relying on each claim as generated is ") .append("reasonable given the CVE's severity and exploitability - it doesn't offer a distinct action per ") .append("claim, since the real options (verify reachability, upgrade the library) are the same regardless of ") @@ -642,6 +662,12 @@ private String rationaleWord(VexStatement s) { return "CVE Not Used " + s.daysObserved + "d"; } + /** Whether CVE Shield could even catch this CVE in this environment scope - "-" means no signal either way. */ + private String shieldLabel(Boolean shieldAvailable) { + if (shieldAvailable == null) return "-"; + return shieldAvailable ? "Yes" : "No"; + } + /** Strips a purl down to "artifact@version" - drops the "pkg:maven//" prefix for a narrow column. */ private String plainLibrary(String purl) { if (purl == null) return "unknown"; diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java index 17c43cc..e98e43c 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java @@ -47,32 +47,39 @@ /** * Generates a CycloneDX VEX (Vulnerability Exploitability eXchange) document for an * application's library vulnerabilities, using Contrast's runtime library-usage and - * CVE Shield/Protect observation data to justify "not affected"/"in triage" claims + * CVE Shield observation data to justify "not affected"/"in triage" claims * rather than fabricating them. * - * Four data sources, all under the same contrast.properties credentials: + * Five data sources, all under the same contrast.properties credentials: * - GET /api/v4/organizations/{org}/applications app first/last seen * - POST /Contrast/api/ng/{org}/libraries/filter per-library CVEs + runtime class-usage - * - GET /api/ns-ui/v1/organizations/{org}/applications/{id}/cves/issues per-CVE per-environment Shield/Protect status - * - GET /Contrast/api/ng/{org}/applications/{id}/servers per-server Assess/Protect module enablement + * - GET /api/ns-ui/v1/organizations/{org}/applications/{id}/cves/issues per-CVE per-environment CVE Shield status + * - GET /Contrast/api/ng/{org}/applications/{id}/servers per-server Assess/ADR module enablement + * - GET /api/ns-ui/v1/organizations/{org}/cves org-wide per-CVE Shield coverage (cveShieldExists) * * Decision rules (see CLAUDE.md discussion - these are policy, not spec): * 1. classes_used == 0 for the app+library -> not_affected / code_not_reachable, unconditional. * 2. classes_used > 0, CVE's env status is PROTECTING/BLOCKED -> not_affected / protected_at_runtime. * 3. classes_used > 0, CVE's env status is EXPOSED/EXPLOITED (or unrecognized) -> no VEX entry; * never suppress a vulnerability we can't positively account for. - * 4. classes_used > 0, CVE's env status is NOT_SEEN (or missing) in every environment observed: + * 4. classes_used > 0, CVE's env status is NOT_SEEN/NO_SHIELD (or missing) in every environment observed: * - days observed >= acceptAfterDays -> not_affected (no justification), detail explains the * day count and threshold as an operational risk-acceptance, not a structural guarantee. * - days observed < acceptAfterDays -> in_triage, detail explains the day count so far. + * NO_SHIELD (confirmed by scanning every app in this org) means CVE Shield has no coverage for this CVE + * in that environment at all, as opposed to NOT_SEEN (Shield exists there and just hasn't fired) - this + * still uses the same duration-based logic as NOT_SEEN, but is reported separately (see + * contrast:shieldAvailable below) since "we haven't seen it" is much weaker when nothing was watching. * - * Not factored into the decision rules above (deliberately - see ProtectionStatus): whether Assess/Protect are + * Not factored into the decision rules above (deliberately - see ModuleStatus): whether Assess/ADR are * even enabled per environment. A "not seen" claim scoped to an environment where Assess itself isn't running * has no runtime evidence behind it at all, but rather than silently changing the claim, that fact is reported - * as its own contrast:assessEnabled and contrast:protectEnabled property (per env) so a human (or the VEX - * Advisor) can weigh it. Note "Protect" here is the classic HTTP-rule-based RASP module (the API's `defend` - * flag) - CVE Shield is a separate, newer microsandbox-based product with no distinct enablement flag found - * in this API; see ProtectionStatus below for what that means for this report. + * as its own contrast:assessEnabled and contrast:adrEnabled property (per env) so a human (or the VEX + * Advisor) can weigh it. ADR (formerly branded "Protect") is the classic HTTP-rule-based RASP module (the + * API's `defend` flag) - a separate product from CVE Shield, which defends specific CVEs via a microsandbox. + * Whether CVE Shield could even catch this CVE at all - contrast:shieldAvailable - prefers the per-app, + * per-environment NO_SHIELD/NOT_SEEN signal above (see shieldAvailability()), falling back to the org-wide + * cveShieldExists flag from /cves only when there's no per-app signal either way (e.g. issue == null). * * Usage: * java -jar runtime-analyst.jar vex --app "MyApp" @@ -82,7 +89,13 @@ public class VEXGenerator { private static final List PROTECTED_STATUSES = List.of("PROTECTING", "BLOCKED"); - private static final List NOT_SEEN_STATUSES = List.of("NOT_SEEN"); + // NO_SHIELD means CVE Shield has no coverage for this CVE in this environment (confirmed by scanning every + // app in this org - it's a real status value, not documented alongside NOT_SEEN/PROTECTING/BLOCKED/etc). + // It still belongs in the duration-based branch below (absence-of-execution is still the applicable + // reasoning), but is tracked separately so the claim can say "there's no Shield to catch this even if it + // did fire" instead of silently reading the same as a live-but-quiet Shield. + private static final List NOT_SEEN_STATUSES = List.of("NOT_SEEN", "NO_SHIELD"); + private static final String NO_SHIELD_STATUS = "NO_SHIELD"; private String baseUrl; // e.g. https://host/api/ns-ui/v1 private String host; // e.g. https://host @@ -293,7 +306,7 @@ private long parseIsoOrEpoch(JsonObject o, String field) { } } - // ---- CVE Shield / Protect status, per app ---- + // ---- CVE Shield status, per app (per-CVE per-environment, from cves/issues) ---- private Map fetchCveIssues(String appId) throws IOException { Map issues = new HashMap<>(); @@ -336,22 +349,19 @@ private Map fetchCveIssues(String appId) throws IOException { return issues; } - // ---- Assess/Protect module enablement, per app ---- + // ---- Assess/ADR module enablement, per app ---- /** - * `defend` is the classic Protect module (HTTP-rule-based RASP) - a different, older product from CVE - * Shield (which defends specific CVEs via a microsandbox, not HTTP rules). This API exposes no separate - * enablement flag for CVE Shield or for "ADR" as a distinct product, so this only reports Protect/Assess - * enablement; it does NOT claim to say whether CVE Shield itself is available or enabled. CVE Shield's own - * per-CVE verdicts (PROTECTING/BLOCKED/etc, from cves/issues) still show up per-claim regardless - see the - * `protected_at_runtime` justification and the devStatus/qaStatus/prodStatus properties below. + * `defend` is ADR (formerly branded "Protect"), the HTTP-rule-based RASP module - a different, older + * product from CVE Shield, which defends specific CVEs via a microsandbox rather than HTTP rules. CVE + * Shield's own coverage/status is NOT derived from this flag - see fetchCveShieldStatus below for that. */ - private static class ProtectionStatus { + private static class ModuleStatus { Boolean assessEnabledDev, assessEnabledQa, assessEnabledProd; - Boolean protectEnabledDev, protectEnabledQa, protectEnabledProd; + Boolean adrEnabledDev, adrEnabledQa, adrEnabledProd; } - private ProtectionStatus fetchProtectionStatus(String appId) throws IOException { + private ModuleStatus fetchModuleStatus(String appId) throws IOException { String url = host + "/Contrast/api/ng/" + orgId + "/applications/" + appId + "/servers"; HttpGet get = new HttpGet(url); get.setHeader("Authorization", authHeader); @@ -365,7 +375,7 @@ private ProtectionStatus fetchProtectionStatus(String appId) throws IOException throw new IOException("Servers API returned status " + statusCode + ": " + body); } - ProtectionStatus ps = new ProtectionStatus(); + ModuleStatus ps = new ModuleStatus(); JsonObject json = gson.fromJson(body, JsonObject.class); if (!json.has("servers")) { return ps; @@ -374,21 +384,68 @@ private ProtectionStatus fetchProtectionStatus(String appId) throws IOException JsonObject server = el.getAsJsonObject(); String env = getStringOrNull(server, "environment"); boolean assess = server.has("assess") && !server.get("assess").isJsonNull() && server.get("assess").getAsBoolean(); - boolean protect = server.has("defend") && !server.get("defend").isJsonNull() && server.get("defend").getAsBoolean(); + boolean adr = server.has("defend") && !server.get("defend").isJsonNull() && server.get("defend").getAsBoolean(); if ("DEVELOPMENT".equals(env)) { ps.assessEnabledDev = orTrue(ps.assessEnabledDev, assess); - ps.protectEnabledDev = orTrue(ps.protectEnabledDev, protect); + ps.adrEnabledDev = orTrue(ps.adrEnabledDev, adr); } else if ("QA".equals(env)) { ps.assessEnabledQa = orTrue(ps.assessEnabledQa, assess); - ps.protectEnabledQa = orTrue(ps.protectEnabledQa, protect); + ps.adrEnabledQa = orTrue(ps.adrEnabledQa, adr); } else if ("PRODUCTION".equals(env)) { ps.assessEnabledProd = orTrue(ps.assessEnabledProd, assess); - ps.protectEnabledProd = orTrue(ps.protectEnabledProd, protect); + ps.adrEnabledProd = orTrue(ps.adrEnabledProd, adr); } } return ps; } + // ---- CVE Shield coverage, org-wide (not per app - fetched once per run) ---- + + /** + * Whether Contrast even HAS a CVE Shield virtual patch for a given CVE at all - a different fact from + * whether it's actively catching that CVE for a specific app/environment (which is what the per-app + * devStatus/qaStatus/prodStatus properties, from cves/issues, already report). + */ + private Map fetchCveShieldStatus() throws IOException { + Map cveShieldExists = new HashMap<>(); + String cursor = ""; + boolean hasMore = true; + + while (hasMore) { + String url = baseUrl + "/organizations/" + orgId + + "/cves?size=100&sort=maxCvssScore,desc&pagination=cursor&cursor=" + cursor + + "&dateInterval%5BstartTime%5D=2000-01-01T00:00:00.000Z" + + "&dateInterval%5BendTime%5D=" + java.time.Instant.now(); + HttpGet get = new HttpGet(url); + get.setHeader("Authorization", authHeader); + get.setHeader("API-Key", apiKey); + get.setHeader("Accept", "application/json"); + + HttpResponse response = httpClient.execute(get); + int statusCode = response.getStatusLine().getStatusCode(); + String body = EntityUtils.toString(response.getEntity()); + if (statusCode != 200) { + throw new IOException("CVEs API returned status " + statusCode + ": " + body); + } + + JsonObject json = gson.fromJson(body, JsonObject.class); + for (JsonElement el : json.getAsJsonArray("items")) { + JsonObject item = el.getAsJsonObject(); + String cveId = item.has("cve") ? getStringOrNull(item.getAsJsonObject("cve"), "id") : null; + if (cveId != null && item.has("cveShieldExists") && !item.get("cveShieldExists").isJsonNull()) { + cveShieldExists.put(cveId, item.get("cveShieldExists").getAsBoolean()); + } + } + + hasMore = json.has("hasMore") && json.get("hasMore").getAsBoolean(); + cursor = json.has("cursor") && !json.get("cursor").isJsonNull() ? json.get("cursor").getAsString() : ""; + if (cursor.isEmpty()) { + hasMore = false; + } + } + return cveShieldExists; + } + /** Null (no server seen yet) stays null only if never set; otherwise ORs across multiple servers in the same env. */ private Boolean orTrue(Boolean existing, boolean value) { return existing == null ? value : (existing || value); @@ -458,12 +515,16 @@ public Bom generateVEX(List apps) throws IOException { List vulnerabilities = new ArrayList<>(); List appComponents = new ArrayList<>(); + System.out.println("\nFetching org-wide CVE Shield coverage..."); + Map cveShieldExists = fetchCveShieldStatus(); + System.out.println(" " + cveShieldExists.size() + " CVEs with known Shield coverage status"); + for (AppInfo app : apps) { System.out.println("\nProcessing " + app.name + " (" + app.id + ")..."); Map cveIssues = fetchCveIssues(app.id); JsonArray libraries = fetchLibraries(app.id); - ProtectionStatus protection = fetchProtectionStatus(app.id); + ModuleStatus protection = fetchModuleStatus(app.id); System.out.println(" " + libraries.size() + " vulnerable libraries, " + cveIssues.size() + " CVE issue records"); appComponents.add(buildAppComponent(app, protection)); @@ -497,7 +558,7 @@ public Bom generateVEX(List apps) throws IOException { Vulnerability v = buildVulnerability( app, group, fileName, fileVersion, hash, classesUsed, classCount, cveId, vuln, cveIssues.get(cveId + "|" + fileVersion), daysObserved, - remediationGuidance, latestVersion); + remediationGuidance, latestVersion, cveShieldExists.get(cveId)); if (v != null) { vulnerabilities.add(v); @@ -519,8 +580,8 @@ public Bom generateVEX(List apps) throws IOException { return bom; } - /** Carries Assess/Protect module-enablement facts (see ProtectionStatus) - one per app, not repeated per statement. */ - private Component buildAppComponent(AppInfo app, ProtectionStatus protection) { + /** Carries Assess/ADR module-enablement facts (see ModuleStatus) - one per app, not repeated per statement. */ + private Component buildAppComponent(AppInfo app, ModuleStatus protection) { Component appComponent = new Component(); appComponent.setType(Component.Type.APPLICATION); appComponent.setName(app.name); @@ -530,9 +591,9 @@ private Component buildAppComponent(AppInfo app, ProtectionStatus protection) { properties.add(property("contrast:assessEnabledDev", enabledLabel(protection.assessEnabledDev))); properties.add(property("contrast:assessEnabledQa", enabledLabel(protection.assessEnabledQa))); properties.add(property("contrast:assessEnabledProd", enabledLabel(protection.assessEnabledProd))); - properties.add(property("contrast:protectEnabledDev", enabledLabel(protection.protectEnabledDev))); - properties.add(property("contrast:protectEnabledQa", enabledLabel(protection.protectEnabledQa))); - properties.add(property("contrast:protectEnabledProd", enabledLabel(protection.protectEnabledProd))); + properties.add(property("contrast:adrEnabledDev", enabledLabel(protection.adrEnabledDev))); + properties.add(property("contrast:adrEnabledQa", enabledLabel(protection.adrEnabledQa))); + properties.add(property("contrast:adrEnabledProd", enabledLabel(protection.adrEnabledProd))); appComponent.setProperties(properties); return appComponent; } @@ -545,7 +606,8 @@ private String enabledLabel(Boolean value) { /** Returns null when the CVE shouldn't get a VEX statement at all (exposed/exploited/unrecognized status). */ private Vulnerability buildVulnerability(AppInfo app, String group, String fileName, String fileVersion, String hash, long classesUsed, long classCount, String cveId, JsonObject vuln, - CveIssue issue, long daysObserved, JsonObject remediationGuidance, String latestVersion) { + CveIssue issue, long daysObserved, JsonObject remediationGuidance, String latestVersion, + Boolean orgWideShieldExists) { Vulnerability v = new Vulnerability(); v.setBomRef(sanitizeBomRef(app.id + "-" + cveId + "-" + hash)); @@ -652,7 +714,7 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN } else if (issue != null && isProtected(issue)) { analysis.setState(State.NOT_AFFECTED); analysis.setJustification(Justification.PROTECTED_AT_RUNTIME); - detail = "CVE Shield/Protect is actively mitigating this vulnerability at runtime in " + app.name + detail = "CVE Shield is actively mitigating this vulnerability at runtime in " + app.name + " (" + envScopeLabel() + ")."; } else if (issue != null && isNotSeen(issue)) { detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used) but this CVE's " @@ -666,6 +728,10 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN analysis.setState(State.IN_TRIAGE); detail += " (below the " + acceptAfterDays + "-day acceptance threshold)."; } + if (Boolean.FALSE.equals(shieldAvailability(issue, orgWideShieldExists))) { + detail += " CVE Shield has no coverage for this CVE in this environment scope, so runtime " + + "observation is the only signal available - there's no active mitigation as a backstop."; + } } else if (issue == null) { // Library confirmed used, but no matching per-CVE environment record found at all - // treat the same as "not seen" using the same duration logic, but flag the missing join. @@ -689,7 +755,7 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN List responses = new ArrayList<>(); if (analysis.getJustification() == Justification.PROTECTED_AT_RUNTIME) { - // The active Shield/Protect control is itself the mitigation in place. + // The active CVE Shield control is itself the mitigation in place. responses.add(Response.WORKAROUND_AVAILABLE); } else if (analysis.getJustification() != Justification.CODE_NOT_REACHABLE && fixAvailable) { responses.add(Response.UPDATE); @@ -717,6 +783,10 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN if (vuln.has("cisa") && !vuln.get("cisa").isJsonNull()) { properties.add(property("contrast:cisaKev", String.valueOf(vuln.get("cisa").getAsBoolean()))); } + Boolean shieldAvailable = shieldAvailability(issue, orgWideShieldExists); + if (shieldAvailable != null) { + properties.add(property("contrast:shieldAvailable", String.valueOf(shieldAvailable))); + } if (latestVersion != null) { properties.add(property("contrast:latestVersion", latestVersion)); } @@ -773,6 +843,28 @@ private boolean isNotSeenOrNull(String status) { return status == null || NOT_SEEN_STATUSES.contains(status); } + /** + * Whether CVE Shield could have caught this CVE at all in the environment(s) being considered - true if any + * considered status is a real (non-null) signal other than NO_SHIELD (even NOT_SEEN implies Shield was + * watching and just hasn't fired), false if every considered status that has any data is explicitly + * NO_SHIELD, or null (unknown) when there's no per-app signal either way and no org-wide fact to fall + * back on. + */ + private Boolean shieldAvailability(CveIssue issue, Boolean orgWideShieldExists) { + if (issue != null) { + boolean anyRealSignal = false; + boolean anyNoShield = false; + for (String status : statusesToConsider(issue)) { + if (status == null) continue; + if (NO_SHIELD_STATUS.equals(status)) anyNoShield = true; + else anyRealSignal = true; + } + if (anyRealSignal) return true; + if (anyNoShield) return false; + } + return orgWideShieldExists; + } + private String artifactNameFrom(String fileName) { if (fileName == null) { return "unknown"; From 0999309af883e15b7408e2a0837f87f3cb4848c5 Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 22:59:01 -0400 Subject: [PATCH 13/16] Never claim not_affected via duration when CVE Shield has no coverage A claim's whole justification for "not_affected" via duration is "we watched for N days and never saw it exploited." That requires something to have been watching. When shieldAvailability() is false - every environment considered is NO_SHIELD - there was no detector at all, so elapsed time proves nothing, and the previous commit's fix was still wrong: it let these graduate to not_affected once daysObserved crossed the threshold anyway (e.g. CVE-2020-11996 on tomcat-embed-core showed VEX=NA, Shield=No, which is self-contradictory - "not seen" from a detector that doesn't exist isn't evidence). Fixed: when shieldAvailability() is false, the claim now stays in_triage permanently, regardless of daysObserved - it can never graduate to not_affected on duration alone. Applies to both the per-app NO_SHIELD branch and the issue==null/org-wide-fallback branch. The 2 statements that are code_not_reachable (0 classes loaded) are correctly unaffected by this - that justification has nothing to do with Shield. Verified against SAML-PetClinic-Demo: CVE-2020-11996 is now IT/No/ "CVE Watching 288d" instead of the previous NA/No/"CVE Not Used 288d". 16 of 251 statements are affected (all NO_SHIELD-only cases). Still 251 total - none dropped, matching the intent of two commits ago (don't silently drop CVEs) without the over-claim this introduced. Regenerated samples/sample-vex.json and sample-vex-advisor.md; re-validated against the CycloneDX 1.6 schema. --- README.md | 7 +- samples/sample-vex-advisor.md | 40 +- samples/sample-vex.json | 782 +++++++++--------- .../runtimeanalyst/VEXGenerator.java | 39 +- 4 files changed, 442 insertions(+), 426 deletions(-) diff --git a/README.md b/README.md index cc0fe76..e1cf037 100644 --- a/README.md +++ b/README.md @@ -140,8 +140,9 @@ By default a claim considers the application's dev/qa/prod environments together → `not_affected` / `protected_at_runtime`. 3. **Library loaded, and this application's CVE status is `EXPOSED`/`EXPLOITED`** → no VEX statement at all. This tool never suppresses a vulnerability it can't positively account for. -4. **Library loaded, but the CVE has never been observed executing in this application** (whether because CVE Shield exists and simply hasn't fired, or because CVE Shield has no coverage for that CVE at all - `NO_SHIELD`, a real per-environment status distinct from `NOT_SEEN`, confirmed by scanning every application in the org) - → a statement is still generated, with the actual number of days recorded as the reason, and which case it was recorded separately (`contrast:shieldAvailable`) - earlier versions of this tool silently dropped `NO_SHIELD`-only CVEs instead of generating a claim for them, which was a bug, not a policy choice. +4. **Library loaded, but the CVE has never been observed executing in this application** - a statement is still generated, but *what* it claims depends on whether CVE Shield exists there at all (`NO_SHIELD`, a real per-environment status distinct from `NOT_SEEN`, confirmed by scanning every application in the org): + - Shield exists and simply hasn't fired (`NOT_SEEN`) → `not_affected` once days observed clears the acceptance threshold, `in_triage` until then - elapsed time is meaningful evidence here, because something was watching. + - Shield has **no coverage at all** for that CVE (`NO_SHIELD` in every environment considered) → `in_triage`, permanently, regardless of days observed. Elapsed time can't turn "no detector was watching" into "nothing happened" - this can never graduate to `not_affected` on duration alone. Earlier versions of this tool either silently dropped these CVEs entirely, or (briefly, mid-development) marked them `not_affected` anyway once enough days had passed - both were bugs, not policy choices. Every statement carries `contrast:*` properties (`classesUsed`/`classCount`, `daysObserved`, `acceptAfterDays`, `envFilter`, and the per-environment `devStatus`/`qaStatus`/`prodStatus`) so a reviewer can see the underlying evidence, not just the resulting state. @@ -208,7 +209,7 @@ A standard CycloneDX 1.6 document with a top-level `vulnerabilities[]` array, on All of the above is deterministic, pulled directly from Contrast's own CVE/library data - nothing here is AI-generated, since a VEX claim is an attestation and needs to stay auditable back to its source evidence. The EPSS/CISA KEV/Shield-availability signals are new inputs to the **VEX Advisor**'s AI judgment (below), not to the claim itself. -`contrast:shieldAvailable` prefers a real, app-scoped signal: Contrast's per-application `cves/issues` endpoint returns a `NO_SHIELD` status (distinct from `NOT_SEEN`, confirmed by scanning every application in this org) meaning CVE Shield has no coverage for that CVE in that environment at all - a materially weaker basis for `not_affected` than `NOT_SEEN` (Shield exists there and simply hasn't fired). When there's no per-app signal either way, it falls back to the org-wide `cveShieldExists` flag from `/organizations/{org}/cves`. Earlier versions of this tool silently *dropped* `NO_SHIELD`-only CVEs from the VEX entirely instead of generating a claim for them - a real bug, since the "never suppress" policy above is meant to apply to `EXPOSED`/`EXPLOITED` CVEs, not ones where CVE Shield just doesn't cover them. +`contrast:shieldAvailable` prefers a real, app-scoped signal: Contrast's per-application `cves/issues` endpoint returns a `NO_SHIELD` status (distinct from `NOT_SEEN`, confirmed by scanning every application in this org) meaning CVE Shield has no coverage for that CVE in that environment at all. When there's no per-app signal either way, it falls back to the org-wide `cveShieldExists` flag from `/organizations/{org}/cves`. This isn't just informational - it changes which state a claim can reach (see policy rule 4 above): when Shield has no coverage, the claim stays `in_triage` forever, since elapsed time without a detector watching is not evidence of anything. The document also has a top-level `components[]` array with one Application component per app, carrying whether Assess (the module that produces every claim's runtime evidence) and ADR (the classic HTTP-rule-based RASP module, formerly branded "Protect" - a different, older product from CVE Shield) are enabled per environment: `contrast:assessEnabledDev`/`Qa`/`Prod` and `contrast:adrEnabledDev`/`Qa`/`Prod` (`"true"`/`"false"`/`""` - empty means no agent was ever seen reporting from that environment, which is a different fact from "disabled"). diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index 4c39b28..0106135 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -18,7 +18,7 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated **Key Findings:** -- **25 of 251 claim(s) flagged for human review** before relying on them. +- **132 of 251 claim(s) flagged for human review** before relying on them. - **8 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. - **11 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+5 more). - Application(s) rated CRITICAL/HIGH risk: SAML-PetClinic-Demo. @@ -62,11 +62,11 @@ Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, s **Protection Status:** Assess (runtime evidence): dev=enabled, qa=no data, prod=enabled · ADR (classic RASP, formerly "Protect" - not CVE Shield): dev=disabled, qa=no data, prod=enabled -SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-databind 2.8.8, tomcat-embed-core 8.5.15, spring-framework 4.3.9, spring-data-commons, hibernate, netty, snakeyaml, etc.), almost all resolved to not_affected. Assess has real runtime coverage in dev and prod (qa has no data, but claims are scoped across all three so dev/prod evidence still backs them), and ADR is enabled in prod but disabled in dev. Most claims rest on solid ground (either code_not_reachable, i.e. zero classes loaded, or duration-based acceptance backed by a CVE Shield backstop and modest EPSS), but a meaningful subset of claims sit on duration-only reasoning for CVEs that are either KEV-listed, have very high EPSS, or have zero CVE Shield coverage at all - those warrant a second look before being relied on as-is. +This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old Spring 4 / Tomcat 8.5 stack with a long tail of ancient, unpatched dependencies (jackson-databind 2.8.8, spring-webmvc/beans/core 4.3.9, tomcat-embed-core 8.5.15, hibernate-core 5.0.4, etc.). About 40% of claims rest on structural code_not_reachable evidence (0 classes ever loaded) and are solid regardless of severity. The remaining majority are 'not_affected' purely on 288 days of no observed execution, and a meaningful chunk of those are critical/high severity CVEs, including several KEV entries (Spring4Shell CVE-2022-22965 across four libraries, Tomcat Ghostcat CVE-2020-1938, CVE-2017-12617, CVE-2023-44487), so this posture leans on absence-of-evidence for some of the industry's best-known exploited bugs. -**Risk Rationale:** Several claims accept CVE-2022-22965 (Spring4Shell), CVE-2020-1938 (Ghostcat), CVE-2017-12617, CVE-2023-44487 (HTTP/2 Rapid Reset), and CVE-2025-24813 as not_affected using only 'no observed execution in 288 days' reasoning - all five are CISA KEV-listed with EPSS at or near 1.0, meaning they are being actively exploited in the wild, and the libraries involved (spring-webmvc, spring-beans, tomcat-embed-core) are heavily loaded (166-387 classes used), so this isn't a dormant/unused dependency. Separately, seven CVEs on tomcat-embed-core, hibernate-validator, and tomcat-embed-websocket have zero CVE Shield coverage in this environment scope while being critical/high severity, meaning there is no active mitigation as a backstop if the absence-of-execution reasoning is wrong - one of these (CVE-2020-13935) also has a very high EPSS (0.87). ADR being disabled in dev further weakens the safety net for any of these claims that turn out to be wrong in that tier. None of this indicates the VEX tool is behaving incorrectly - the reasoning and thresholds are applied consistently - but the specific CVEs above carry enough real-world exploitation weight that a human should confirm reachability before treating them as settled. +**Risk Rationale:** Assess has full data in dev/prod (qa has none, but dev+prod coverage means the duration-based evidence isn't zero), and ADR is enabled in prod, so there is an active backstop where these apps actually run. That keeps this from being CRITICAL. However, a large number of critical/high-severity CVEs (all of jackson-databind's critical CVEs, Spring4Shell on spring-beans/spring-webmvc/spring-web-adjacent spring-data-commons, Tomcat's KEV entries CVE-2020-1938/CVE-2017-12617/CVE-2023-44487, CVE-2025-24813) are resolved to not_affected using only 'no execution observed in 288 days,' which is explicitly called out as weak evidence for high-stakes CVEs regardless of how long the window is. Additionally several critical/high CVEs (tomcat-embed-core CVE-2026-41293/CVE-2025-66614, tomcat-embed-websocket CVE-2020-13935 with EPSS 0.87, hibernate-validator CVE-2025-35036) have zero CVE Shield coverage at all, meaning no active mitigation could have caught an exploit attempt even in principle. -**Recommendation:** Have a human reviewer confirm reachability (not just absence-of-execution) for the five KEV-listed CVEs (CVE-2022-22965 on spring-webmvc/spring-beans, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487, CVE-2025-24813 on tomcat-embed-core) before relying on the not_affected claims, given active-exploitation status and heavy class loading. Also review the seven CVE-Shield-uncovered critical/high findings (CVE-2026-41293, CVE-2025-66614, CVE-2020-11996, CVE-2026-24880, CVE-2026-42498 on tomcat-embed-core; CVE-2020-13935 on tomcat-embed-websocket; CVE-2025-35036 on hibernate-validator) since there's no active backstop if the duration-based call is wrong. Given the volume of tomcat-embed-core and jackson-databind CVEs stacked on ancient versions, prioritize the upgrade path over continued risk acceptance. Consider enabling ADR in dev to restore a mitigating control tier-wide. +**Recommendation:** Prioritize human review of: (1) every jackson-databind critical/high CVE (2018-14721 through 2019-12086) given the sheer number of gadget-chain CVEs riding on duration alone, (2) all four instances of CVE-2022-22965 (Spring4Shell, KEV) across spring-beans/spring-webmvc/spring-data-commons/spring-boot-starter-web, (3) the Tomcat KEV entries (CVE-2020-1938, CVE-2017-12617, CVE-2023-44487, CVE-2025-24813), and (4) the no-Shield-coverage in_triage critical/high items (CVE-2026-41293, CVE-2025-66614, CVE-2020-13935, CVE-2025-35036). Given the age of this stack, an actual dependency upgrade is likely cheaper than continuing to carry this much duration-based acceptance on critical CVEs. | CVE | Library | Score | VEX | Shield | Rationale | |-----|---------|-------|-----|--------|-----------| @@ -81,7 +81,7 @@ SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-da | CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Yes | Library Unused | | CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | Yes | CVE Not Used 288d | | CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | Yes | CVE Not Used 288d | -| CVE-2020-13935 | tomcat-embed-websocket@8.5.15 | 7.5 | NA | No | CVE Not Used 288d | +| CVE-2020-13935 | tomcat-embed-websocket@8.5.15 | 7.5 | IT | No | CVE Watching 288d | | CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | @@ -100,7 +100,7 @@ SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-da | CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Yes | Library Unused | -| CVE-2020-11996 | tomcat-embed-core@8.5.15 | 7.5 | NA | No | CVE Not Used 288d | +| CVE-2020-11996 | tomcat-embed-core@8.5.15 | 7.5 | IT | No | CVE Watching 288d | | CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | Yes | CVE Not Used 288d | | CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | Yes | CVE Not Used 288d | @@ -150,7 +150,7 @@ SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-da | CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | | CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Yes | Library Unused | -| CVE-2020-1935 | tomcat-embed-core@8.5.15 | 4.8 | NA | No | CVE Not Used 288d | +| CVE-2020-1935 | tomcat-embed-core@8.5.15 | 4.8 | IT | No | CVE Watching 288d | | CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | @@ -171,8 +171,8 @@ SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-da | CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Yes | Library Unused | | CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Yes | Library Unused | -| CVE-2023-41080 | tomcat-embed-core@8.5.15 | 6.1 | NA | No | CVE Not Used 288d | -| CVE-2023-45648 | tomcat-embed-core@8.5.15 | 5.3 | NA | No | CVE Not Used 288d | +| CVE-2023-41080 | tomcat-embed-core@8.5.15 | 6.1 | IT | No | CVE Watching 288d | +| CVE-2023-45648 | tomcat-embed-core@8.5.15 | 5.3 | IT | No | CVE Watching 288d | | CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | @@ -190,7 +190,7 @@ SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-da | CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Yes | Library Unused | -| CVE-2018-10237 | guava@19.0 | 5.9 | NA | No | CVE Not Used 288d | +| CVE-2018-10237 | guava@19.0 | 5.9 | IT | No | CVE Watching 288d | | CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Yes | Library Unused | | CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | Yes | CVE Not Used 288d | | CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Yes | Library Unused | @@ -221,7 +221,7 @@ SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-da | CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | | CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | -| CVE-2026-41293 | tomcat-embed-core@8.5.15 | 9.8 | NA | No | CVE Not Used 288d | +| CVE-2026-41293 | tomcat-embed-core@8.5.15 | 9.8 | IT | No | CVE Watching 288d | | CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | @@ -236,7 +236,7 @@ SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-da | CVE-2020-15250 | junit@4.12 | 5.5 | NA | Yes | Library Unused | | CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Yes | CVE Not Used 288d | -| CVE-2020-10693 | hibernate-validator@5.3.5.Final | 5.3 | NA | No | CVE Not Used 288d | +| CVE-2020-10693 | hibernate-validator@5.3.5.Final | 5.3 | IT | No | CVE Watching 288d | | CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Yes | Library Unused | | CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Yes | Library Unused | | CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | @@ -251,12 +251,12 @@ SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-da | CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | -| CVE-2026-24880 | tomcat-embed-core@8.5.15 | 7.5 | NA | No | CVE Not Used 288d | +| CVE-2026-24880 | tomcat-embed-core@8.5.15 | 7.5 | IT | No | CVE Watching 288d | | CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Yes | Library Unused | | CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Yes | Library Unused | | CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | -| CVE-2026-42498 | tomcat-embed-core@8.5.15 | 7.3 | NA | No | CVE Not Used 288d | -| CVE-2025-35036 | hibernate-validator@5.3.5.Final | 7.3 | NA | No | CVE Not Used 288d | +| CVE-2026-42498 | tomcat-embed-core@8.5.15 | 7.3 | IT | No | CVE Watching 288d | +| CVE-2025-35036 | hibernate-validator@5.3.5.Final | 7.3 | IT | No | CVE Watching 288d | | CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | | CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | | CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | @@ -282,7 +282,7 @@ SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-da | CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Yes | Library Unused | | CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | Yes | CVE Not Used 288d | | CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | Yes | CVE Not Used 288d | -| CVE-2025-66614 | tomcat-embed-core@8.5.15 | 9.1 | NA | No | CVE Not Used 288d | +| CVE-2025-66614 | tomcat-embed-core@8.5.15 | 9.1 | IT | No | CVE Watching 288d | | CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Yes | CVE Not Used 288d | | CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Yes | Library Unused | | CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | @@ -300,19 +300,19 @@ SAML-PetClinic-Demo has 251 VEX claims across ~30 outdated libraries (jackson-da | CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | | CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | | CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | -| CVE-2023-1932 | hibernate-validator@5.3.5.Final | 6.1 | NA | No | CVE Not Used 288d | +| CVE-2023-1932 | hibernate-validator@5.3.5.Final | 6.1 | IT | No | CVE Watching 288d | | CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Yes | Library Unused | -| CVE-2026-54515 | jackson-databind@2.8.8 | 5.3 | NA | No | CVE Not Used 288d | -| CVE-2026-54514 | jackson-databind@2.8.8 | 5.3 | NA | No | CVE Not Used 288d | +| CVE-2026-54515 | jackson-databind@2.8.8 | 5.3 | IT | No | CVE Watching 288d | +| CVE-2026-54514 | jackson-databind@2.8.8 | 5.3 | IT | No | CVE Watching 288d | | CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | Yes | CVE Not Used 288d | -| CVE-2026-43514 | tomcat-embed-core@8.5.15 | 3.7 | NA | No | CVE Not Used 288d | +| CVE-2026-43514 | tomcat-embed-core@8.5.15 | 3.7 | IT | No | CVE Watching 288d | | CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | Yes | CVE Not Used 288d | | CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | Yes | CVE Not Used 288d | | CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | diff --git a/samples/sample-vex.json b/samples/sample-vex.json index ee990fc..492675e 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -3,7 +3,7 @@ "specVersion": "1.6", "version": 1, "metadata": { - "timestamp": "2026-09-03T02:41:45Z", + "timestamp": "2026-09-03T02:53:20Z", "component": { "type": "application", "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", @@ -176,11 +176,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE but EPSS is low (0.1) and CVE Shield is available as a backstop; 288 days comfortably exceeds the 30-day threshold." + "value": "jackson-databind: critical severity (10.0) resolved to not_affected purely on 288 days of no observed execution; absence-of-evidence isn\u0027t a strong enough basis for a maximum-severity CVE." } ] }, @@ -290,11 +290,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield available as backstop, duration well past threshold." + "value": "jackson-databind: critical CVE resolved on duration alone with no structural reachability guarantee; should be reviewed before relying on it." } ] }, @@ -408,7 +408,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.5 (98.81 percentile) is notably high for a critical CVE relying only on duration-based reasoning; worth confirming reachability despite Shield coverage." + "value": "jackson-databind: critical CVE with elevated EPSS (0.5) resolved purely on duration; the higher exploit probability makes absence-of-execution weaker evidence here." } ] }, @@ -518,11 +518,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS (0.27), Shield backstop present, duration well past threshold." + "value": "jackson-databind: critical severity resolved on 288 days of non-execution alone; worth a human check given the severity." } ] }, @@ -632,11 +632,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -746,11 +746,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -860,11 +860,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -974,11 +974,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -1088,11 +1088,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -1202,11 +1202,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -1316,11 +1316,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -1430,11 +1430,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -1544,11 +1544,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -1658,11 +1658,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -1772,11 +1772,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -1886,11 +1886,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -2000,11 +2000,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -2114,11 +2114,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -2228,11 +2228,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -2342,11 +2342,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.38 is elevated but below the flag threshold, and Shield is available; acceptable to rely on as-is but not far from warranting a check." + "value": "jackson-databind: critical CVE with high EPSS (0.38) resolved purely on duration; elevated exploit likelihood makes this worth a second look." } ] }, @@ -2456,11 +2456,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE with elevated EPSS (0.2), duration-only justification." } ] }, @@ -2570,11 +2570,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -2684,11 +2684,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -2798,11 +2798,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." } ] }, @@ -2912,11 +2912,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, high severity but Shield backstop present." + "value": "jackson-databind: high-severity CVE resolved purely on 288 days without execution; no structural non-reachability backing it." } ] }, @@ -3026,11 +3026,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -3140,11 +3140,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -3254,11 +3254,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -3368,11 +3368,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -3482,11 +3482,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -3596,11 +3596,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -3710,11 +3710,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -3824,11 +3824,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -3938,11 +3938,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE with EPSS 0.21, duration-only justification." } ] }, @@ -4052,11 +4052,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -4166,11 +4166,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -4280,11 +4280,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -4394,11 +4394,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -4508,11 +4508,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -4622,11 +4622,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -4736,11 +4736,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -4850,11 +4850,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -4964,11 +4964,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -5078,11 +5078,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -5192,11 +5192,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -5306,11 +5306,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -5420,11 +5420,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE with EPSS 0.18, duration-only justification." } ] }, @@ -5534,11 +5534,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -5648,11 +5648,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -5762,11 +5762,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -5876,11 +5876,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE, duration-only justification." } ] }, @@ -5990,11 +5990,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "jackson-databind: high-severity CVE with EPSS 0.22, duration-only justification." } ] }, @@ -6108,7 +6108,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes for duration-only acceptance." + "value": "jackson-databind: medium severity accepted on duration alone; lower stakes even with an elevated EPSS." } ] }, @@ -6222,7 +6222,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "jackson-databind: medium severity accepted on duration alone; acceptable as-is." } ] }, @@ -6248,11 +6248,11 @@ "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.", "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2026-54515. Latest available release is 2.22.1.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -6336,7 +6336,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity with no Shield coverage - lower stakes given severity, so duration-only acceptance is reasonable here." + "value": "jackson-databind: correctly left in_triage since Shield has no coverage; medium severity and negligible EPSS keep stakes low." } ] }, @@ -6362,11 +6362,11 @@ "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2026-54514. Latest available release is 2.22.1.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -6450,7 +6450,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity with no Shield coverage - lower stakes given severity." + "value": "jackson-databind: correctly left in_triage since Shield has no coverage; medium severity, low EPSS, acceptable to leave open." } ] }, @@ -6562,7 +6562,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable (0 of 1295 classes loaded) - structural fact, safe to rely on regardless of severity." + "value": "htmlunit: 0 of 1295 classes ever loaded is a structural fact, safe to rely on despite critical severity." } ] }, @@ -6674,7 +6674,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "htmlunit: code_not_reachable (0 classes loaded), a structural guarantee independent of severity." } ] }, @@ -6784,11 +6784,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Only 1 of 190 classes loaded, low EPSS, Shield backstop present." + "value": "dom4j: critical CVE resolved purely on duration (library barely used - 1 of 190 classes - but not code_not_reachable), so it still rests on absence-of-execution." } ] }, @@ -6898,11 +6898,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "dom4j: high-severity CVE, duration-only justification despite minimal library usage." } ] }, @@ -7014,7 +7014,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable (0 of 206 classes) - structural fact; safe despite EPSS 1.0 since the classes were never loaded." + "value": "snakeyaml: 0 of 206 classes ever loaded, code_not_reachable - structurally sound even at critical severity and near-max EPSS." } ] }, @@ -7126,7 +7126,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "snakeyaml: code_not_reachable, structural fact." } ] }, @@ -7238,7 +7238,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "snakeyaml: code_not_reachable, structural fact." } ] }, @@ -7350,7 +7350,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "snakeyaml: code_not_reachable, structural fact." } ] }, @@ -7462,7 +7462,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "snakeyaml: code_not_reachable, structural fact." } ] }, @@ -7574,7 +7574,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "snakeyaml: code_not_reachable, structural fact." } ] }, @@ -7686,7 +7686,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "snakeyaml: code_not_reachable, structural fact." } ] }, @@ -7798,7 +7798,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "snakeyaml: code_not_reachable, structural fact." } ] }, @@ -7910,7 +7910,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Spring-beans: CISA KEV-listed Spring4Shell, EPSS 1.0, 202/408 classes loaded - active exploitation in the wild means duration-only reasoning should be double-checked here too." + "value": "spring-beans: critical severity AND KEV (Spring4Shell), resolved purely on duration with the library actively used (202/408 classes)." } ] }, @@ -8024,7 +8024,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "CISA KEV-listed, EPSS 0.97, and the claim rests only on 288-day absence-of-execution with 152/554 classes actively loaded - active exploitation in the wild plus real usage of the library warrants human confirmation of reachability." + "value": "spring-data-commons: critical severity AND KEV (actively exploited), resolved purely on 288 days without observed execution - this is exactly the combination flagged as weakest evidence." } ] }, @@ -8134,11 +8134,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "spring-data-commons: high-severity CVE, duration-only justification." } ] }, @@ -8248,11 +8248,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "spring-data-commons: high-severity CVE, duration-only justification." } ] }, @@ -8366,7 +8366,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-data-commons: medium severity accepted on duration alone, acceptable." } ] }, @@ -8480,7 +8480,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-data-commons: medium severity accepted on duration alone, acceptable." } ] }, @@ -8592,7 +8592,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown/no severity score, low stakes." + "value": "spring-data-commons: unscored/unknown severity accepted on duration alone; low stakes." } ] }, @@ -8702,11 +8702,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "hsqldb: critical-severity CVE resolved purely on duration, no structural guarantee." } ] }, @@ -8816,11 +8816,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: low EPSS, Shield backstop present." + "value": "logback-classic: critical-severity CVE, duration-only justification." } ] }, @@ -8930,11 +8930,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: very low EPSS, Shield backstop present." + "value": "logback-classic: high-severity CVE, duration-only justification." } ] }, @@ -9048,7 +9048,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "logback-core: medium severity accepted on duration alone, acceptable." } ] }, @@ -9160,7 +9160,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "No severity score assigned, low stakes." + "value": "logback-core: unscored severity, duration acceptance is low stakes." } ] }, @@ -9272,7 +9272,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "No severity score assigned, low stakes." + "value": "logback-core: unscored severity, low stakes." } ] }, @@ -9384,7 +9384,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "No severity score assigned, low stakes." + "value": "logback-core: unscored severity, low stakes." } ] }, @@ -9496,7 +9496,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "No severity score assigned, low stakes." + "value": "logback-core: unscored severity, low stakes." } ] }, @@ -9608,7 +9608,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "No severity score assigned, low stakes." + "value": "logback-core: unscored severity, low stakes." } ] }, @@ -9720,7 +9720,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "No severity score assigned, low stakes." + "value": "logback-core: unscored severity, low stakes." } ] }, @@ -9830,11 +9830,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.32 is elevated but below flag threshold, Shield backstop present." + "value": "spring-web: critical severity with elevated EPSS (0.32), resolved purely on duration." } ] }, @@ -9944,11 +9944,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "spring-web: high-severity CVE, duration-only justification." } ] }, @@ -10058,11 +10058,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "spring-web: high-severity CVE, duration-only justification." } ] }, @@ -10172,11 +10172,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "spring-web: high-severity CVE, duration-only justification." } ] }, @@ -10290,7 +10290,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-web: medium severity accepted on duration alone, acceptable." } ] }, @@ -10404,7 +10404,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-context: medium severity, lower stakes." + "value": "spring-context: medium severity, duration acceptance is fine - distinct component from the spring-web finding above with the same CVE ID." } ] }, @@ -10518,7 +10518,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-web: medium severity accepted on duration alone, acceptable." } ] }, @@ -10632,7 +10632,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Spring-beans: CISA KEV-listed Spring4Shell, EPSS 1.0, 202/408 classes loaded - active exploitation in the wild means duration-only reasoning should be double-checked here too." + "value": "spring-beans: critical severity AND KEV (Spring4Shell), resolved purely on duration with the library actively used (202/408 classes)." } ] }, @@ -10742,11 +10742,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "spring-webmvc: high-severity CVE, duration-only justification." } ] }, @@ -10860,7 +10860,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.55 on a high-severity spring-webmvc CVE actively loaded (166/498 classes) - elevated exploitation likelihood warrants a closer look despite Shield coverage." + "value": "spring-webmvc: high-severity CVE with elevated EPSS (0.55), duration-only justification." } ] }, @@ -10974,7 +10974,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-webmvc: medium severity, duration acceptance is fine." } ] }, @@ -11088,7 +11088,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-webmvc: medium severity, duration acceptance is fine." } ] }, @@ -11202,7 +11202,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-webmvc: medium severity, duration acceptance is fine." } ] }, @@ -11316,7 +11316,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-webmvc: medium severity, duration acceptance is fine." } ] }, @@ -11430,7 +11430,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-webmvc: medium severity, duration acceptance is fine." } ] }, @@ -11544,7 +11544,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-webmvc: medium severity, duration acceptance is fine." } ] }, @@ -11658,7 +11658,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-webmvc: medium severity, duration acceptance is fine." } ] }, @@ -11772,7 +11772,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, lower stakes." + "value": "spring-webmvc: low severity, duration acceptance is fine." } ] }, @@ -11882,11 +11882,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: low EPSS, Shield backstop present." + "value": "logback-classic: critical-severity CVE, duration-only justification." } ] }, @@ -11996,11 +11996,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: very low EPSS, Shield backstop present." + "value": "logback-classic: high-severity CVE, duration-only justification." } ] }, @@ -12114,7 +12114,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Spring-beans: CISA KEV-listed Spring4Shell, EPSS 1.0, 202/408 classes loaded - active exploitation in the wild means duration-only reasoning should be double-checked here too." + "value": "spring-beans: critical severity AND KEV (Spring4Shell), resolved purely on duration with the library actively used (202/408 classes)." } ] }, @@ -12228,7 +12228,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-beans: medium severity, duration acceptance is fine." } ] }, @@ -12338,11 +12338,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "tomcat-embed-core: critical-severity CVE, duration-only justification." } ] }, @@ -12456,7 +12456,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "CISA KEV-listed, EPSS 1.0, tomcat-embed-core is heavily loaded (387/1481 classes) - critical actively-exploited RCE relying solely on absence-of-execution needs human confirmation." + "value": "tomcat-embed-core: critical severity AND KEV (actively exploited), resolved purely on duration - highest-stakes combination flagged." } ] }, @@ -12566,11 +12566,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: critical-severity CVE, duration-only justification." } ] }, @@ -12596,11 +12596,11 @@ "description": "Improper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-41293. Latest available release is 10.1.57.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -12684,7 +12684,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with zero CVE Shield coverage in this environment scope - no active mitigation backstop if the duration-based reasoning is wrong." + "value": "tomcat-embed-core: critical CVE correctly left in_triage since CVE Shield has no coverage at all - no active backstop and no structural guarantee, worth surfacing rather than letting sit." } ] }, @@ -12798,7 +12798,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "CISA KEV-listed Ghostcat, EPSS 0.99, tomcat-embed-core heavily loaded - active exploitation in the wild, duration-only claim needs confirmation." + "value": "tomcat-embed-core: critical severity AND KEV (Ghostcat, actively exploited), resolved purely on duration - flagged combination." } ] }, @@ -12908,11 +12908,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: critical-severity CVE, duration-only justification." } ] }, @@ -13022,11 +13022,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.44 is elevated but below flag threshold; Shield backstop present." + "value": "tomcat-embed-core: critical CVE with elevated EPSS (0.44), duration-only justification." } ] }, @@ -13136,11 +13136,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: critical-severity CVE, duration-only justification." } ] }, @@ -13166,11 +13166,11 @@ "description": "Improper Input Validation vulnerability.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.\nTomcat did not validate that the host name provided via the SNI \nextension was the same as the host name provided in the HTTP host header \nfield. If Tomcat was configured with more than one virtual host and the \nTLS configuration for one of those hosts did not require client \ncertificate authentication but another one did, it was possible for a \nclient to bypass the client certificate authentication by sending \ndifferent host names in the SNI extension and the HTTP host header field.\n\n\n\nThe vulnerability only applies if client certificate authentication is \nonly enforced at the Connector. It does not apply if client certificate \nauthentication is enforced at the web application.\n\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.", "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-66614. Latest available release is 10.1.57.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -13254,7 +13254,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with zero CVE Shield coverage - no active backstop; runtime observation is the only signal." + "value": "tomcat-embed-core: critical CVE correctly left in_triage since CVE Shield has no coverage at all - no active backstop, worth surfacing." } ] }, @@ -13368,7 +13368,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 1.0 on a high-severity CVE with the library heavily loaded - very high exploitation likelihood warrants confirmation despite Shield coverage." + "value": "tomcat-embed-core: high-severity CVE with EPSS 1.0 (near-certain exploitation likelihood), resolved purely on duration." } ] }, @@ -13482,7 +13482,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "CISA KEV-listed, EPSS 1.0 - actively exploited RCE; duration-only reasoning should be confirmed." + "value": "tomcat-embed-core: high severity, KEV, and EPSS 1.0 - resolved purely on duration; among the strongest cases to double-check." } ] }, @@ -13596,7 +13596,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.73 on a high-severity CVE - elevated real-world exploitation likelihood warrants a closer look." + "value": "tomcat-embed-core: high severity with EPSS 0.73, duration-only justification." } ] }, @@ -13706,11 +13706,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -13820,11 +13820,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -13934,11 +13934,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -14052,7 +14052,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.67 on a high-severity CVE - elevated exploitation likelihood warrants confirmation." + "value": "tomcat-embed-core: high severity with EPSS 0.67, duration-only justification." } ] }, @@ -14162,11 +14162,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -14280,7 +14280,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.73 on a high-severity CVE - elevated exploitation likelihood warrants confirmation." + "value": "tomcat-embed-core: high severity with EPSS 0.73, duration-only justification." } ] }, @@ -14390,11 +14390,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -14504,11 +14504,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -14618,11 +14618,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -14736,7 +14736,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.57 on a high-severity CVE - elevated exploitation likelihood warrants confirmation." + "value": "tomcat-embed-core: high severity with EPSS 0.57, duration-only justification." } ] }, @@ -14846,11 +14846,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -14960,11 +14960,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -15074,11 +15074,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -15188,11 +15188,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -15302,11 +15302,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -15420,7 +15420,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.6 on a high-severity CVE - elevated exploitation likelihood warrants confirmation." + "value": "tomcat-embed-core: high severity with EPSS 0.6, duration-only justification." } ] }, @@ -15446,11 +15446,11 @@ "description": "A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.", "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-11996. Latest available release is 10.1.57.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -15534,7 +15534,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with zero CVE Shield coverage - no active backstop for this duration-based claim." + "value": "tomcat-embed-core: high-severity CVE with EPSS 0.27, correctly left in_triage since Shield has no coverage - no backstop, worth surfacing." } ] }, @@ -15644,11 +15644,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "tomcat-embed-core: high severity with EPSS 0.23, duration-only justification." } ] }, @@ -15674,11 +15674,11 @@ "description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.", "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-24880. Latest available release is 10.1.57.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -15762,7 +15762,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with zero CVE Shield coverage - no active backstop." + "value": "tomcat-embed-core: high-severity CVE correctly left in_triage since Shield has no coverage - no backstop, worth surfacing." } ] }, @@ -15876,7 +15876,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "CISA KEV-listed HTTP/2 Rapid Reset, EPSS 1.0 - actively exploited DoS; duration-only reasoning should be confirmed." + "value": "tomcat-embed-core: high severity, KEV (HTTP/2 Rapid Reset, actively exploited), EPSS 1.0, resolved purely on duration - among the strongest cases to double-check." } ] }, @@ -15986,11 +15986,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -16016,11 +16016,11 @@ "description": "Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.", "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-42498. Latest available release is 10.1.57.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -16104,7 +16104,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with zero CVE Shield coverage - no active backstop." + "value": "tomcat-embed-core: high-severity CVE correctly left in_triage since Shield has no coverage - no backstop, worth surfacing." } ] }, @@ -16214,11 +16214,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -16328,11 +16328,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -16442,11 +16442,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "tomcat-embed-core: high-severity CVE, duration-only justification." } ] }, @@ -16560,7 +16560,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.57 on a high-severity CVE - elevated exploitation likelihood warrants confirmation." + "value": "tomcat-embed-core: high severity with EPSS 0.57, duration-only justification." } ] }, @@ -16674,7 +16674,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "tomcat-embed-core: medium severity, duration acceptance is fine." } ] }, @@ -16700,11 +16700,11 @@ "description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.\n\nThe vulnerability is limited to the ROOT (default) web application.", "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-41080. Latest available release is 10.1.57.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -16788,7 +16788,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity with no Shield coverage - lower stakes given severity." + "value": "tomcat-embed-core: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." } ] }, @@ -16902,7 +16902,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes despite moderate EPSS." + "value": "tomcat-embed-core: medium severity, duration acceptance is fine despite elevated EPSS." } ] }, @@ -17016,7 +17016,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "tomcat-embed-core: medium severity, duration acceptance is fine." } ] }, @@ -17130,7 +17130,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "tomcat-embed-core: medium severity, duration acceptance is fine." } ] }, @@ -17244,7 +17244,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "tomcat-embed-core: medium severity, duration acceptance is fine." } ] }, @@ -17358,7 +17358,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "tomcat-embed-core: medium severity, duration acceptance is fine." } ] }, @@ -17472,7 +17472,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "tomcat-embed-core: medium severity, duration acceptance is fine." } ] }, @@ -17586,7 +17586,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "tomcat-embed-core: medium severity, duration acceptance is fine." } ] }, @@ -17612,11 +17612,11 @@ "description": "Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially \ncrafted, invalid trailer header could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.\n\n", "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-45648. Latest available release is 10.1.57.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -17700,7 +17700,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity with no Shield coverage - lower stakes given severity." + "value": "tomcat-embed-core: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." } ] }, @@ -17726,11 +17726,11 @@ "description": "In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.", "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-1935. Latest available release is 10.1.57.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -17814,7 +17814,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity with no Shield coverage - lower stakes given severity." + "value": "tomcat-embed-core: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." } ] }, @@ -17928,7 +17928,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity (4.3) - lower stakes despite high EPSS, per severity-based risk tiering." + "value": "tomcat-embed-core: medium severity, duration acceptance is fine despite high EPSS (0.94), lower stakes than critical/high." } ] }, @@ -17954,11 +17954,11 @@ "description": "Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43514. Latest available release is 10.1.57.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -18042,7 +18042,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity - lower stakes even with no Shield coverage." + "value": "tomcat-embed-core: low severity correctly left in_triage with no Shield coverage; acceptable to leave open." } ] }, @@ -18154,7 +18154,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "plexus-utils: code_not_reachable (0 of 102 classes), structural fact regardless of critical severity." } ] }, @@ -18266,7 +18266,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "plexus-utils: code_not_reachable, structural fact." } ] }, @@ -18378,7 +18378,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "plexus-utils: code_not_reachable, structural fact." } ] }, @@ -18490,7 +18490,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "plexus-utils: code_not_reachable, structural fact." } ] }, @@ -18602,7 +18602,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "netty: code_not_reachable (0 of 727 classes), structural fact regardless of critical severity." } ] }, @@ -18714,7 +18714,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "netty: code_not_reachable, structural fact." } ] }, @@ -18826,7 +18826,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "netty: code_not_reachable, structural fact." } ] }, @@ -18938,7 +18938,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "netty: code_not_reachable, structural fact." } ] }, @@ -19050,7 +19050,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "netty: code_not_reachable, structural fact." } ] }, @@ -19162,7 +19162,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "netty: code_not_reachable, structural fact." } ] }, @@ -19274,7 +19274,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "netty: code_not_reachable, structural fact." } ] }, @@ -19386,7 +19386,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "netty: code_not_reachable, structural fact." } ] }, @@ -19498,7 +19498,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "netty: code_not_reachable, structural fact." } ] }, @@ -19608,7 +19608,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "netty: code_not_reachable, structural fact." } ] }, @@ -19720,7 +19720,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "jetty-http: code_not_reachable (0 of 81 classes), structural fact regardless of critical severity." } ] }, @@ -19832,7 +19832,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "jetty-http: code_not_reachable, structural fact." } ] }, @@ -19944,7 +19944,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "jetty-http: code_not_reachable, structural fact." } ] }, @@ -20056,7 +20056,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "jetty-http: code_not_reachable, structural fact." } ] }, @@ -20168,7 +20168,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "jetty-http: code_not_reachable, structural fact." } ] }, @@ -20278,11 +20278,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS despite critical severity, Shield backstop present." + "value": "thymeleaf: critical-severity CVE resolved purely on duration despite heavy library usage (367/549 classes)." } ] }, @@ -20392,11 +20392,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "thymeleaf: critical-severity CVE, duration-only justification." } ] }, @@ -20506,11 +20506,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "thymeleaf: critical-severity CVE, duration-only justification." } ] }, @@ -20620,11 +20620,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "mysql-connector-java: high-severity CVE, duration-only justification." } ] }, @@ -20734,11 +20734,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "mysql-connector-java: high-severity CVE, duration-only justification." } ] }, @@ -20852,7 +20852,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "mysql-connector-java: medium severity, duration acceptance is fine." } ] }, @@ -20964,7 +20964,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "No severity score assigned, low stakes." + "value": "mysql-connector-java: unscored severity, low stakes." } ] }, @@ -21076,7 +21076,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "spring-boot-starter-actuator: code_not_reachable with 0 of 0 total classes - aggregator artifact with no classes of its own, trivially valid." } ] }, @@ -21186,11 +21186,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "spring-boot: high-severity CVE, duration-only justification." } ] }, @@ -21300,11 +21300,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "spring-boot: high-severity CVE, duration-only justification." } ] }, @@ -21414,11 +21414,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "spring-boot: high-severity CVE, duration-only justification." } ] }, @@ -21532,7 +21532,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-boot: medium severity, duration acceptance is fine." } ] }, @@ -21644,7 +21644,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact, safe to rely on regardless of the missing Shield coverage." + "value": "neko-htmlunit: code_not_reachable (0 of 53 classes) - structural fact even though Shield has no coverage for this one, since reachability is not probabilistic." } ] }, @@ -21756,7 +21756,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "neko-htmlunit: code_not_reachable, structural fact." } ] }, @@ -21866,11 +21866,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Moderate EPSS, Shield backstop present." + "value": "gson: high-severity CVE, duration-only justification despite partial library usage (36/174 classes)." } ] }, @@ -21982,7 +21982,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "commons-compress: code_not_reachable (0 of 200 classes), structural fact regardless of high severity." } ] }, @@ -22094,7 +22094,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "commons-compress: code_not_reachable, structural fact." } ] }, @@ -22206,7 +22206,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "commons-compress: code_not_reachable, structural fact." } ] }, @@ -22318,7 +22318,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact." + "value": "commons-compress: code_not_reachable, structural fact." } ] }, @@ -22430,7 +22430,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "commons-compress: code_not_reachable, structural fact." } ] }, @@ -22542,7 +22542,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "commons-compress: code_not_reachable, structural fact." } ] }, @@ -22656,7 +22656,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.81 on a high-severity, actively-exploited-in-practice XSLT injection CVE relying only on 288-day duration-based reasoning - worth confirming despite minimal class usage (7/1501)." + "value": "xalan: high-severity CVE with high EPSS (0.81), resolved on duration alone though library barely used (7/1501 classes) - not code_not_reachable, so still absence-of-execution." } ] }, @@ -22766,11 +22766,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "spring-core: high-severity CVE, duration-only justification." } ] }, @@ -22880,11 +22880,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "spring-core: high-severity CVE, duration-only justification." } ] }, @@ -22994,11 +22994,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "spring-core: high-severity CVE, duration-only justification." } ] }, @@ -23108,11 +23108,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "spring-core: high-severity CVE, duration-only justification." } ] }, @@ -23226,7 +23226,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-core: medium severity, duration acceptance is fine." } ] }, @@ -23340,7 +23340,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes despite moderate EPSS." + "value": "spring-core: medium severity, duration acceptance is fine despite elevated EPSS (0.35)." } ] }, @@ -23454,7 +23454,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-core: medium severity, duration acceptance is fine." } ] }, @@ -23568,7 +23568,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-core: medium severity, duration acceptance is fine." } ] }, @@ -23678,11 +23678,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "spring-expression: high-severity CVE, duration-only justification." } ] }, @@ -23792,11 +23792,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "spring-expression: high-severity CVE, duration-only justification." } ] }, @@ -23906,11 +23906,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "spring-expression: high-severity CVE, duration-only justification." } ] }, @@ -24024,7 +24024,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-expression: medium severity, duration acceptance is fine." } ] }, @@ -24138,7 +24138,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-expression: medium severity, duration acceptance is fine." } ] }, @@ -24252,7 +24252,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes despite moderate EPSS." + "value": "spring-expression: medium severity, duration acceptance is fine despite elevated EPSS (0.36)." } ] }, @@ -24366,7 +24366,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-expression: medium severity, duration acceptance is fine." } ] }, @@ -24480,7 +24480,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-expression: medium severity, duration acceptance is fine." } ] }, @@ -24590,11 +24590,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present." + "value": "spring-boot-autoconfigure: high-severity CVE, duration-only justification." } ] }, @@ -24620,11 +24620,11 @@ "description": "The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.", "recommendation": "Upgrade tomcat-embed-websocket from 8.5.15 to 8.0.32 to remediate CVE-2020-13935. Latest available release is 10.1.4.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (25 of 168 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (25 of 168 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -24708,7 +24708,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.87, and zero CVE Shield coverage in this environment scope - both the exploitation likelihood and absence of a backstop make this the weakest claim in the dataset." + "value": "tomcat-embed-websocket: high severity with EPSS 0.87 (near-certain exploitation likelihood), correctly left in_triage since Shield has no coverage - no backstop, this is the highest-priority in_triage item to review." } ] }, @@ -24822,7 +24822,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, Shield backstop present." + "value": "tomcat-embed-websocket: medium severity, duration acceptance is fine." } ] }, @@ -24932,11 +24932,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, Shield backstop present (library very heavily loaded at 1563/3787 classes, but the specific vulnerable path is unobserved with backstop in place)." + "value": "hibernate-core: high-severity CVE, duration-only justification despite heavy library usage (1563/3787 classes)." } ] }, @@ -25050,7 +25050,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "hibernate-core: medium severity, duration acceptance is fine." } ] }, @@ -25076,11 +25076,11 @@ "description": "Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.", "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2025-35036.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -25164,7 +25164,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with zero CVE Shield coverage in this environment scope - no active backstop for this duration-based claim." + "value": "hibernate-validator: high-severity CVE correctly left in_triage since Shield has no coverage - no backstop, worth surfacing." } ] }, @@ -25274,11 +25274,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "hibernate-validator: high-severity CVE, duration-only justification." } ] }, @@ -25304,11 +25304,11 @@ "description": "A flaw was found in hibernate-validator\u0027s \u0027isValid\u0027 method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.", "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2023-1932.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -25392,7 +25392,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity with no Shield coverage - lower stakes given severity." + "value": "hibernate-validator: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." } ] }, @@ -25418,11 +25418,11 @@ "description": "A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.", "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2020-10693.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -25506,7 +25506,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity with no Shield coverage - lower stakes given severity." + "value": "hibernate-validator: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." } ] }, @@ -25616,11 +25616,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield backstop present." + "value": "guava: high-severity CVE, duration-only justification (5/1717 classes used, not code_not_reachable)." } ] }, @@ -25646,11 +25646,11 @@ "description": "Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.", "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2018-10237.", "analysis": { - "state": "not_affected", + "state": "in_triage", "response": [ "update" ], - "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee. CVE Shield has no coverage for this CVE in this environment scope, so runtime observation is the only signal available - there\u0027s no active mitigation as a backstop." + "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." }, "affects": [ { @@ -25734,7 +25734,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity with no Shield coverage - lower stakes given severity." + "value": "guava: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." } ] }, @@ -25848,7 +25848,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, lower stakes." + "value": "guava: low severity, duration acceptance is fine." } ] }, @@ -25960,7 +25960,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "No severity score assigned, Shield backstop present." + "value": "xercesimpl: unscored severity, duration acceptance is low stakes." } ] }, @@ -26072,7 +26072,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "No severity score assigned, Shield backstop present." + "value": "xercesimpl: unscored severity, low stakes despite elevated EPSS." } ] }, @@ -26186,7 +26186,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "xercesimpl: medium severity, duration acceptance is fine." } ] }, @@ -26300,7 +26300,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "xercesimpl: medium severity, duration acceptance is fine." } ] }, @@ -26414,7 +26414,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-boot-actuator: medium severity, duration acceptance is fine." } ] }, @@ -26526,7 +26526,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "bootstrap (webjar): code_not_reachable with 0 of 0 classes - a JS-only webjar has no Java classes to load, so this is trivially and structurally valid." } ] }, @@ -26638,7 +26638,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "bootstrap (webjar): code_not_reachable, structural fact for a JS-only artifact." } ] }, @@ -26750,7 +26750,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "bootstrap (webjar): code_not_reachable, structural fact for a JS-only artifact." } ] }, @@ -26862,7 +26862,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "bootstrap (webjar): code_not_reachable, structural fact for a JS-only artifact." } ] }, @@ -26974,7 +26974,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "bootstrap (webjar): code_not_reachable, structural fact for a JS-only artifact." } ] }, @@ -27086,7 +27086,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "bootstrap (webjar): code_not_reachable, structural fact for a JS-only artifact." } ] }, @@ -27198,7 +27198,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity, junit is a test-only dependency." + "value": "junit: code_not_reachable (0 of 286 classes), a test-scope library that\u0027s plausibly never loaded at runtime - structurally sound." } ] }, @@ -27310,7 +27310,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-lang3: code_not_reachable - structural fact." + "value": "commons-lang3: code_not_reachable (0 of 152 classes), structural fact - distinct component from the commons-lang finding above with the same CVE ID." } ] }, @@ -27422,7 +27422,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-lang3: code_not_reachable - structural fact." + "value": "commons-lang3: code_not_reachable (0 of 152 classes), structural fact - distinct component from the commons-lang finding above with the same CVE ID." } ] }, @@ -27536,7 +27536,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-data-jpa: medium severity, duration acceptance is fine." } ] }, @@ -27650,7 +27650,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-data-jpa: medium severity, duration acceptance is fine." } ] }, @@ -27764,7 +27764,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "spring-context: medium severity, duration acceptance is fine." } ] }, @@ -27878,7 +27878,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-context: medium severity, lower stakes." + "value": "spring-context: medium severity, duration acceptance is fine - distinct component from the spring-web finding above with the same CVE ID." } ] }, @@ -27992,7 +27992,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, lower stakes." + "value": "spring-context: low severity, duration acceptance is fine." } ] }, @@ -28104,7 +28104,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "httpclient: code_not_reachable (0 of 466 classes), structural fact." } ] }, @@ -28216,7 +28216,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable - structural fact, safe regardless of missing Shield coverage." + "value": "commons-io: code_not_reachable (0 of 110 classes) - structural fact independent of the fact that Shield has no coverage here." } ] }, @@ -28328,7 +28328,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, medium severity." + "value": "commons-io: code_not_reachable, structural fact." } ] }, @@ -28442,7 +28442,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes." + "value": "jackson-core: medium severity, duration acceptance is fine." } ] }, @@ -28554,7 +28554,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "No severity score assigned, low stakes." + "value": "jackson-core: unscored severity, low stakes." } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java index e98e43c..bc64a47 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java @@ -63,13 +63,17 @@ * 3. classes_used > 0, CVE's env status is EXPOSED/EXPLOITED (or unrecognized) -> no VEX entry; * never suppress a vulnerability we can't positively account for. * 4. classes_used > 0, CVE's env status is NOT_SEEN/NO_SHIELD (or missing) in every environment observed: - * - days observed >= acceptAfterDays -> not_affected (no justification), detail explains the - * day count and threshold as an operational risk-acceptance, not a structural guarantee. - * - days observed < acceptAfterDays -> in_triage, detail explains the day count so far. * NO_SHIELD (confirmed by scanning every app in this org) means CVE Shield has no coverage for this CVE - * in that environment at all, as opposed to NOT_SEEN (Shield exists there and just hasn't fired) - this - * still uses the same duration-based logic as NOT_SEEN, but is reported separately (see - * contrast:shieldAvailable below) since "we haven't seen it" is much weaker when nothing was watching. + * in that environment at all, as opposed to NOT_SEEN (Shield exists there and just hasn't fired). This + * matters for the state, not just the reporting: elapsed time can never turn "no detector was watching" + * into "nothing happened," so: + * - shieldAvailability() is false (every considered env is NO_SHIELD) -> in_triage, permanently, + * regardless of daysObserved - this can never graduate to not_affected on duration alone. + * - shieldAvailability() is true/unknown and days observed >= acceptAfterDays -> not_affected (no + * justification), detail explains the day count and threshold as an operational risk-acceptance, + * not a structural guarantee. + * - shieldAvailability() is true/unknown and days observed < acceptAfterDays -> in_triage, detail + * explains the day count so far (may still graduate to not_affected later). * * Not factored into the decision rules above (deliberately - see ModuleStatus): whether Assess/ADR are * even enabled per environment. A "not seen" claim scoped to an environment where Assess itself isn't running @@ -717,10 +721,19 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN detail = "CVE Shield is actively mitigating this vulnerability at runtime in " + app.name + " (" + envScopeLabel() + ")."; } else if (issue != null && isNotSeen(issue)) { + boolean shieldAvail = !Boolean.FALSE.equals(shieldAvailability(issue, orgWideShieldExists)); detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used) but this CVE's " + "vulnerable code path has not been observed executing in " + app.name + " (" + envScopeLabel() + ") in " + daysObserved + " days of runtime monitoring"; - if (daysObserved >= acceptAfterDays) { + if (!shieldAvail) { + // CVE Shield has no coverage for this CVE here at all, so there was never anything watching for + // an exploit attempt - elapsed time cannot turn "nothing detected" into "nothing happened." This + // can never graduate to not_affected on duration alone, no matter how long it's been. + analysis.setState(State.IN_TRIAGE); + detail += ". CVE Shield has no coverage for this CVE in this environment scope, so there is no " + + "detection mechanism to have caught an exploit attempt - this cannot be resolved to " + + "not_affected by elapsed time alone, regardless of the " + acceptAfterDays + "-day threshold."; + } else if (daysObserved >= acceptAfterDays) { analysis.setState(State.NOT_AFFECTED); detail += " (policy threshold: " + acceptAfterDays + " days). Operational risk acceptance based on " + "runtime observation, not a structural non-reachability guarantee."; @@ -728,17 +741,19 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN analysis.setState(State.IN_TRIAGE); detail += " (below the " + acceptAfterDays + "-day acceptance threshold)."; } - if (Boolean.FALSE.equals(shieldAvailability(issue, orgWideShieldExists))) { - detail += " CVE Shield has no coverage for this CVE in this environment scope, so runtime " - + "observation is the only signal available - there's no active mitigation as a backstop."; - } } else if (issue == null) { // Library confirmed used, but no matching per-CVE environment record found at all - // treat the same as "not seen" using the same duration logic, but flag the missing join. + boolean shieldAvail = !Boolean.FALSE.equals(shieldAvailability(null, orgWideShieldExists)); detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used); no per-environment " + "CVE Shield/exposure record found for this CVE+version in " + app.name + ". Not observed " + "executing in " + daysObserved + " days of runtime monitoring for this application"; - if (daysObserved >= acceptAfterDays) { + if (!shieldAvail) { + analysis.setState(State.IN_TRIAGE); + detail += ". CVE Shield has no coverage for this CVE at all (org-wide), so there is no detection " + + "mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by " + + "elapsed time alone, regardless of the " + acceptAfterDays + "-day threshold."; + } else if (daysObserved >= acceptAfterDays) { analysis.setState(State.NOT_AFFECTED); detail += " (policy threshold: " + acceptAfterDays + " days). Operational risk acceptance based on " + "runtime observation, not a structural non-reachability guarantee."; From e59a4d5d3ba87531896627b52dba69630592877a Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 23:05:03 -0400 Subject: [PATCH 14/16] Give the shield-unavailable in_triage case its own rationale word "CVE Watching 288d" was still misleading after the last fix: it's the same label used for a claim genuinely still accumulating days toward the acceptance threshold, but 288 days against a 30-day threshold reads as a bug, not the intended "can never graduate" state. Added a distinct rationale word - "No Shield Coverage Nd" - for in_triage claims where shieldAvailable is false, so the table itself makes clear this is permanent, not still-in-progress. Legend updated to explain both in_triage variants separately. Regenerated samples/sample-vex-advisor.md by re-running vex-advisor against the existing sample-vex.json (no generator changes needed - this was a report-layer wording fix). --- samples/sample-vex-advisor.md | 45 +- samples/sample-vex.json | 520 +++++++++--------- .../runtimeanalyst/VEXAdvisor.java | 16 +- 3 files changed, 296 insertions(+), 285 deletions(-) diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index 0106135..b25061b 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -18,7 +18,7 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated **Key Findings:** -- **132 of 251 claim(s) flagged for human review** before relying on them. +- **141 of 251 claim(s) flagged for human review** before relying on them. - **8 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. - **11 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+5 more). - Application(s) rated CRITICAL/HIGH risk: SAML-PetClinic-Demo. @@ -39,14 +39,15 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated **Shield** - whether CVE Shield could catch this specific CVE at all in the environment(s) considered: `Yes` (Shield exists there, even if it hasn't fired), `No` (no Shield coverage for this CVE at all - the claim rests entirely on absence-of-execution, with no possible active backstop), `-` (no signal either way). -**Rationale** - why the claim was made, with the day count for the two duration-based reasons: +**Rationale** - why the claim was made, with the day count for the three duration-based reasons: | Rationale | Meaning | |-----------|---------| | `Library Unused` | Library never loaded at runtime (0 classes) - structural, not time-based | | `CVE Shielded` | CVE Shield actively mitigating at runtime - an active control, not time-based | | `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold | -| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold | +| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold - may still graduate to `CVE Not Used` | +| `No Shield Coverage Nd` | in_triage, permanently - CVE Shield has no coverage for this CVE here (Shield column is `No`), so elapsed time is never evidence of anything and this can never graduate, no matter how large Nd gets | Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth a second look surface at the top - see the Key Findings above for which specific CVEs those are. @@ -62,11 +63,11 @@ Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, s **Protection Status:** Assess (runtime evidence): dev=enabled, qa=no data, prod=enabled · ADR (classic RASP, formerly "Protect" - not CVE Shield): dev=disabled, qa=no data, prod=enabled -This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old Spring 4 / Tomcat 8.5 stack with a long tail of ancient, unpatched dependencies (jackson-databind 2.8.8, spring-webmvc/beans/core 4.3.9, tomcat-embed-core 8.5.15, hibernate-core 5.0.4, etc.). About 40% of claims rest on structural code_not_reachable evidence (0 classes ever loaded) and are solid regardless of severity. The remaining majority are 'not_affected' purely on 288 days of no observed execution, and a meaningful chunk of those are critical/high severity CVEs, including several KEV entries (Spring4Shell CVE-2022-22965 across four libraries, Tomcat Ghostcat CVE-2020-1938, CVE-2017-12617, CVE-2023-44487), so this posture leans on absence-of-evidence for some of the industry's best-known exploited bugs. +SAML-PetClinic-Demo has roughly 210 VEX claims across ~40 vulnerable libraries (jackson-databind, tomcat-embed-core, spring-webmvc/web/beans/core/expression, spring-data-commons, hibernate, netty, snakeyaml, dom4j, guava, and others). Assess has real runtime data in dev and prod (qa has none), and ADR is active in prod but off in dev. A large minority of claims are code_not_reachable (structural, sound), but a much larger share are 'not_affected' resting solely on 288 days of no-observed-execution, including several critical/KEV CVEs (Spring4Shell CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487) and a long tail of critical/high tomcat-embed-core and jackson-databind CVEs. -**Risk Rationale:** Assess has full data in dev/prod (qa has none, but dev+prod coverage means the duration-based evidence isn't zero), and ADR is enabled in prod, so there is an active backstop where these apps actually run. That keeps this from being CRITICAL. However, a large number of critical/high-severity CVEs (all of jackson-databind's critical CVEs, Spring4Shell on spring-beans/spring-webmvc/spring-web-adjacent spring-data-commons, Tomcat's KEV entries CVE-2020-1938/CVE-2017-12617/CVE-2023-44487, CVE-2025-24813) are resolved to not_affected using only 'no execution observed in 288 days,' which is explicitly called out as weak evidence for high-stakes CVEs regardless of how long the window is. Additionally several critical/high CVEs (tomcat-embed-core CVE-2026-41293/CVE-2025-66614, tomcat-embed-websocket CVE-2020-13935 with EPSS 0.87, hibernate-validator CVE-2025-35036) have zero CVE Shield coverage at all, meaning no active mitigation could have caught an exploit attempt even in principle. +**Risk Rationale:** The code_not_reachable claims (htmlunit, snakeyaml, netty, jetty-http, plexus-utils, commons-compress, junit, commons-lang/lang3, commons-io, bootstrap, spring-boot-starter-web/actuator) are structural and sound regardless of severity. However, a very large number of critical and high severity CVEs - including six KEV entries - are resolved to not_affected using duration-only reasoning (288 days vs a 30-day threshold) rather than code_not_reachable or an active CVE Shield mitigation. CVE Shield exists for most of these but has not necessarily fired, so the claim still rests primarily on absence-of-execution for internet-facing, high-EPSS libraries (tomcat-embed-core, jackson-databind, spring-webmvc, spring-data-commons). A smaller set of in_triage claims (mostly on tomcat-embed-core, hibernate-validator, guava) have no CVE Shield coverage at all, meaning there is no backstop if the reachability assumption is wrong. ADR being disabled in dev further reduces the safety net for any of these in that environment. -**Recommendation:** Prioritize human review of: (1) every jackson-databind critical/high CVE (2018-14721 through 2019-12086) given the sheer number of gadget-chain CVEs riding on duration alone, (2) all four instances of CVE-2022-22965 (Spring4Shell, KEV) across spring-beans/spring-webmvc/spring-data-commons/spring-boot-starter-web, (3) the Tomcat KEV entries (CVE-2020-1938, CVE-2017-12617, CVE-2023-44487, CVE-2025-24813), and (4) the no-Shield-coverage in_triage critical/high items (CVE-2026-41293, CVE-2025-66614, CVE-2020-13935, CVE-2025-35036). Given the age of this stack, an actual dependency upgrade is likely cheaper than continuing to carry this much duration-based acceptance on critical CVEs. +**Recommendation:** Prioritize a human reachability review for the KEV-listed critical CVEs (CVE-2022-22965 on spring-webmvc/spring-beans, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487) before relying on the VEX as-is, since these are actively exploited in the wild and currently rest on duration-only evidence. Also review the in_triage CVEs lacking CVE Shield coverage (tomcat-embed-core CVE-2026-41293/2025-66614/2020-11996/2026-24880/2026-42498/2023-45648/2020-1935/2026-43514, hibernate-validator CVE-2025-35036/2023-1932/2020-10693, guava CVE-2018-10237, jackson-databind CVE-2026-54515/2026-54514) since nothing would have caught an exploit attempt regardless of elapsed time. The code_not_reachable claims and the medium/low severity duration-based claims can be relied on without further review. | CVE | Library | Score | VEX | Shield | Rationale | |-----|---------|-------|-----|--------|-----------| @@ -81,7 +82,7 @@ This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old S | CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Yes | Library Unused | | CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | Yes | CVE Not Used 288d | | CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | Yes | CVE Not Used 288d | -| CVE-2020-13935 | tomcat-embed-websocket@8.5.15 | 7.5 | IT | No | CVE Watching 288d | +| CVE-2020-13935 | tomcat-embed-websocket@8.5.15 | 7.5 | IT | No | No Shield Coverage 288d | | CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | @@ -100,7 +101,7 @@ This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old S | CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Yes | Library Unused | -| CVE-2020-11996 | tomcat-embed-core@8.5.15 | 7.5 | IT | No | CVE Watching 288d | +| CVE-2020-11996 | tomcat-embed-core@8.5.15 | 7.5 | IT | No | No Shield Coverage 288d | | CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | Yes | CVE Not Used 288d | | CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | Yes | CVE Not Used 288d | @@ -150,7 +151,7 @@ This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old S | CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | | CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Yes | Library Unused | -| CVE-2020-1935 | tomcat-embed-core@8.5.15 | 4.8 | IT | No | CVE Watching 288d | +| CVE-2020-1935 | tomcat-embed-core@8.5.15 | 4.8 | IT | No | No Shield Coverage 288d | | CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | @@ -171,8 +172,8 @@ This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old S | CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Yes | Library Unused | | CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Yes | Library Unused | -| CVE-2023-41080 | tomcat-embed-core@8.5.15 | 6.1 | IT | No | CVE Watching 288d | -| CVE-2023-45648 | tomcat-embed-core@8.5.15 | 5.3 | IT | No | CVE Watching 288d | +| CVE-2023-41080 | tomcat-embed-core@8.5.15 | 6.1 | IT | No | No Shield Coverage 288d | +| CVE-2023-45648 | tomcat-embed-core@8.5.15 | 5.3 | IT | No | No Shield Coverage 288d | | CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | @@ -190,7 +191,7 @@ This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old S | CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Yes | Library Unused | -| CVE-2018-10237 | guava@19.0 | 5.9 | IT | No | CVE Watching 288d | +| CVE-2018-10237 | guava@19.0 | 5.9 | IT | No | No Shield Coverage 288d | | CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Yes | Library Unused | | CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | Yes | CVE Not Used 288d | | CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Yes | Library Unused | @@ -221,7 +222,7 @@ This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old S | CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | | CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | -| CVE-2026-41293 | tomcat-embed-core@8.5.15 | 9.8 | IT | No | CVE Watching 288d | +| CVE-2026-41293 | tomcat-embed-core@8.5.15 | 9.8 | IT | No | No Shield Coverage 288d | | CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | @@ -236,7 +237,7 @@ This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old S | CVE-2020-15250 | junit@4.12 | 5.5 | NA | Yes | Library Unused | | CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Yes | CVE Not Used 288d | -| CVE-2020-10693 | hibernate-validator@5.3.5.Final | 5.3 | IT | No | CVE Watching 288d | +| CVE-2020-10693 | hibernate-validator@5.3.5.Final | 5.3 | IT | No | No Shield Coverage 288d | | CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Yes | Library Unused | | CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Yes | Library Unused | | CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | @@ -251,12 +252,12 @@ This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old S | CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | -| CVE-2026-24880 | tomcat-embed-core@8.5.15 | 7.5 | IT | No | CVE Watching 288d | +| CVE-2026-24880 | tomcat-embed-core@8.5.15 | 7.5 | IT | No | No Shield Coverage 288d | | CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Yes | Library Unused | | CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Yes | Library Unused | | CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | -| CVE-2026-42498 | tomcat-embed-core@8.5.15 | 7.3 | IT | No | CVE Watching 288d | -| CVE-2025-35036 | hibernate-validator@5.3.5.Final | 7.3 | IT | No | CVE Watching 288d | +| CVE-2026-42498 | tomcat-embed-core@8.5.15 | 7.3 | IT | No | No Shield Coverage 288d | +| CVE-2025-35036 | hibernate-validator@5.3.5.Final | 7.3 | IT | No | No Shield Coverage 288d | | CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | | CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | | CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | @@ -282,7 +283,7 @@ This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old S | CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Yes | Library Unused | | CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | Yes | CVE Not Used 288d | | CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | Yes | CVE Not Used 288d | -| CVE-2025-66614 | tomcat-embed-core@8.5.15 | 9.1 | IT | No | CVE Watching 288d | +| CVE-2025-66614 | tomcat-embed-core@8.5.15 | 9.1 | IT | No | No Shield Coverage 288d | | CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Yes | CVE Not Used 288d | | CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Yes | Library Unused | | CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | @@ -300,19 +301,19 @@ This inventory contains roughly 250 VEX claims for SAML-PetClinic-Demo, an old S | CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | | CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | | CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | -| CVE-2023-1932 | hibernate-validator@5.3.5.Final | 6.1 | IT | No | CVE Watching 288d | +| CVE-2023-1932 | hibernate-validator@5.3.5.Final | 6.1 | IT | No | No Shield Coverage 288d | | CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Yes | Library Unused | -| CVE-2026-54515 | jackson-databind@2.8.8 | 5.3 | IT | No | CVE Watching 288d | -| CVE-2026-54514 | jackson-databind@2.8.8 | 5.3 | IT | No | CVE Watching 288d | +| CVE-2026-54515 | jackson-databind@2.8.8 | 5.3 | IT | No | No Shield Coverage 288d | +| CVE-2026-54514 | jackson-databind@2.8.8 | 5.3 | IT | No | No Shield Coverage 288d | | CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | Yes | CVE Not Used 288d | -| CVE-2026-43514 | tomcat-embed-core@8.5.15 | 3.7 | IT | No | CVE Watching 288d | +| CVE-2026-43514 | tomcat-embed-core@8.5.15 | 3.7 | IT | No | No Shield Coverage 288d | | CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | Yes | CVE Not Used 288d | | CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | Yes | CVE Not Used 288d | | CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | diff --git a/samples/sample-vex.json b/samples/sample-vex.json index 492675e..0eba04f 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -180,7 +180,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical severity (10.0) resolved to not_affected purely on 288 days of no observed execution; absence-of-evidence isn\u0027t a strong enough basis for a maximum-severity CVE." + "value": "Critical severity jackson-databind CVE resolved to not_affected on 288 days of no execution alone; CVE Shield exists but hasn\u0027t necessarily fired, so this rests on absence-of-evidence for a critical RCE-class library." } ] }, @@ -294,7 +294,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE resolved on duration alone with no structural reachability guarantee; should be reviewed before relying on it." + "value": "Same duration-only reasoning pattern on a critical jackson-databind deserialization CVE; worth a reachability check before trusting fully." } ] }, @@ -408,7 +408,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE with elevated EPSS (0.5) resolved purely on duration; the higher exploit probability makes absence-of-execution weaker evidence here." + "value": "Critical CVE with relatively high EPSS (98.8th percentile) resolved by duration alone rather than structural non-reachability." } ] }, @@ -522,7 +522,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical severity resolved on 288 days of non-execution alone; worth a human check given the severity." + "value": "Critical severity, high EPSS percentile, resolved only via elapsed-time observation rather than code_not_reachable or an active Shield mitigation." } ] }, @@ -636,7 +636,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Critical jackson-databind deserialization gadget CVE resting on duration-only reasoning." } ] }, @@ -750,7 +750,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Critical severity claim based solely on absence of observed execution over 288 days." } ] }, @@ -864,7 +864,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Duration-only justification for a critical jackson-databind CVE; deserves a closer look given severity." } ] }, @@ -978,7 +978,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Same pattern - critical severity resolved by elapsed time alone." } ] }, @@ -1092,7 +1092,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Critical CVE, duration-based not_affected claim, worth verifying before relying on it." } ] }, @@ -1206,7 +1206,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Critical severity gadget-chain CVE resolved via absence-of-execution reasoning only." } ] }, @@ -1320,7 +1320,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Duration-only claim on a critical jackson-databind CVE." } ] }, @@ -1434,7 +1434,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Critical severity, resolved solely by elapsed monitoring time rather than structural evidence." } ] }, @@ -1548,7 +1548,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Critical severity CVE resting on duration-only reasoning; should be double-checked." } ] }, @@ -1662,7 +1662,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Same duration-only pattern for a critical deserialization CVE." } ] }, @@ -1776,7 +1776,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Critical severity claim relying only on absence of observed execution." } ] }, @@ -1890,7 +1890,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Duration-only justification on a critical jackson-databind CVE." } ] }, @@ -2004,7 +2004,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Critical severity, resolved via elapsed time only, no code_not_reachable or Shield mitigation cited." } ] }, @@ -2118,7 +2118,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Same duration-only pattern for a critical gadget CVE." } ] }, @@ -2232,7 +2232,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Critical severity CVE resolved solely on absence-of-execution grounds." } ] }, @@ -2346,7 +2346,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE with high EPSS (0.38) resolved purely on duration; elevated exploit likelihood makes this worth a second look." + "value": "Critical CVE with a notably high EPSS (98.8th percentile) resolved only by duration; especially worth a second look given the exploitation likelihood." } ] }, @@ -2460,7 +2460,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE with elevated EPSS (0.2), duration-only justification." + "value": "Critical severity claim resting on elapsed-time reasoning alone." } ] }, @@ -2574,7 +2574,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Duration-only not_affected claim on a critical CVE." } ] }, @@ -2688,7 +2688,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Critical severity CVE resolved via absence-of-execution only." } ] }, @@ -2802,7 +2802,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: critical CVE, duration-only justification, no structural guarantee." + "value": "Same duration-only pattern for a critical jackson-databind CVE." } ] }, @@ -2916,7 +2916,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE resolved purely on 288 days without execution; no structural non-reachability backing it." + "value": "High severity CVE resolved solely by elapsed monitoring time rather than structural evidence." } ] }, @@ -3030,7 +3030,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -3144,7 +3144,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on absence of observed execution." } ] }, @@ -3258,7 +3258,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "Same duration-only pattern for a high severity jackson-databind CVE." } ] }, @@ -3372,7 +3372,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity, resolved via elapsed time only." } ] }, @@ -3486,7 +3486,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "Duration-only reasoning on a high severity CVE." } ] }, @@ -3600,7 +3600,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on absence-of-execution." } ] }, @@ -3714,7 +3714,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "Same duration-only pattern for a high severity CVE." } ] }, @@ -3828,7 +3828,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -3942,7 +3942,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE with EPSS 0.21, duration-only justification." + "value": "High severity CVE with elevated EPSS (97.4th percentile) resolved only by elapsed time." } ] }, @@ -4056,7 +4056,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on absence-of-execution." } ] }, @@ -4170,7 +4170,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "Same duration-only pattern for a high severity CVE." } ] }, @@ -4284,7 +4284,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -4398,7 +4398,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on elapsed monitoring time." } ] }, @@ -4512,7 +4512,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "Same duration-only pattern for a high severity CVE." } ] }, @@ -4626,7 +4626,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity, resolved via absence-of-execution only." } ] }, @@ -4740,7 +4740,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on duration reasoning." } ] }, @@ -4854,7 +4854,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity CVE resolved only by elapsed time." } ] }, @@ -4968,7 +4968,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -5082,7 +5082,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on absence-of-execution." } ] }, @@ -5196,7 +5196,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity, resolved via elapsed time only, no structural or active-control evidence." } ] }, @@ -5310,7 +5310,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "Same duration-only pattern for a high severity CVE." } ] }, @@ -5424,7 +5424,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE with EPSS 0.18, duration-only justification." + "value": "High severity CVE with elevated EPSS resolved only by elapsed monitoring time." } ] }, @@ -5538,7 +5538,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -5652,7 +5652,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on absence-of-execution." } ] }, @@ -5766,7 +5766,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "High severity CVE resolved only via elapsed time." } ] }, @@ -5880,7 +5880,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE, duration-only justification." + "value": "Same duration-only pattern for a high severity CVE." } ] }, @@ -5994,7 +5994,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: high-severity CVE with EPSS 0.22, duration-only justification." + "value": "High severity CVE with elevated EPSS (97.5th percentile) resolved only by duration." } ] }, @@ -6108,7 +6108,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: medium severity accepted on duration alone; lower stakes even with an elevated EPSS." + "value": "Medium severity; duration-only acceptance is acceptable at this risk level even with a moderately high EPSS." } ] }, @@ -6222,7 +6222,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: medium severity accepted on duration alone; acceptable as-is." + "value": "Medium severity claim; duration-based acceptance is reasonable at this stakes level." } ] }, @@ -6332,11 +6332,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: correctly left in_triage since Shield has no coverage; medium severity and negligible EPSS keep stakes low." + "value": "In_triage with no CVE Shield coverage at all - correctly left open rather than closed, but flagged as an unresolved risk needing attention." } ] }, @@ -6446,11 +6446,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-databind: correctly left in_triage since Shield has no coverage; medium severity, low EPSS, acceptable to leave open." + "value": "Same as above: in_triage, no Shield coverage, still an open item worth tracking." } ] }, @@ -6562,7 +6562,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "htmlunit: 0 of 1295 classes ever loaded is a structural fact, safe to rely on despite critical severity." + "value": "code_not_reachable with 0 of 1295 classes loaded is a structural fact, safe to rely on regardless of critical severity." } ] }, @@ -6674,7 +6674,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "htmlunit: code_not_reachable (0 classes loaded), a structural guarantee independent of severity." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -6788,7 +6788,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "dom4j: critical CVE resolved purely on duration (library barely used - 1 of 190 classes - but not code_not_reachable), so it still rests on absence-of-execution." + "value": "Critical severity dom4j XXE/RCE CVE resolved by duration only despite the library being loaded (1 of 190 classes)." } ] }, @@ -6902,7 +6902,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "dom4j: high-severity CVE, duration-only justification despite minimal library usage." + "value": "High severity, duration-only justification on a loaded library." } ] }, @@ -7014,7 +7014,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "snakeyaml: 0 of 206 classes ever loaded, code_not_reachable - structurally sound even at critical severity and near-max EPSS." + "value": "code_not_reachable (0 of 206 classes) is a structural fact; despite the very high EPSS, the justification type is sound and not duration-based." } ] }, @@ -7126,7 +7126,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "snakeyaml: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -7238,7 +7238,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "snakeyaml: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -7350,7 +7350,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "snakeyaml: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -7462,7 +7462,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "snakeyaml: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -7574,7 +7574,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "snakeyaml: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -7686,7 +7686,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "snakeyaml: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -7798,7 +7798,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "snakeyaml: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -7910,7 +7910,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-beans: critical severity AND KEV (Spring4Shell), resolved purely on duration with the library actively used (202/408 classes)." + "value": "On spring-beans, KEV critical Spring4Shell resolved by duration alone rather than structural non-reachability, despite active library usage." } ] }, @@ -8024,7 +8024,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-data-commons: critical severity AND KEV (actively exploited), resolved purely on 288 days without observed execution - this is exactly the combination flagged as weakest evidence." + "value": "KEV-listed critical CVE with 97%+ EPSS resolved on duration alone despite the library being actively loaded (152 of 554 classes) - this is exactly the pattern that warrants human verification." } ] }, @@ -8138,7 +8138,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-data-commons: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on absence-of-execution." } ] }, @@ -8252,7 +8252,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-data-commons: high-severity CVE, duration-only justification." + "value": "High severity CVE resolved only by elapsed monitoring time." } ] }, @@ -8366,7 +8366,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-data-commons: medium severity accepted on duration alone, acceptable." + "value": "Medium severity; duration-only acceptance reasonable at this risk level." } ] }, @@ -8480,7 +8480,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-data-commons: medium severity accepted on duration alone, acceptable." + "value": "Medium severity; duration-only acceptance reasonable at this risk level." } ] }, @@ -8592,7 +8592,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-data-commons: unscored/unknown severity accepted on duration alone; low stakes." + "value": "Unscored/unknown severity; duration-based acceptance is low-stakes here." } ] }, @@ -8706,7 +8706,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "hsqldb: critical-severity CVE resolved purely on duration, no structural guarantee." + "value": "Critical severity hsqldb CVE resolved only by absence-of-execution over the observation window." } ] }, @@ -8820,7 +8820,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: critical-severity CVE, duration-only justification." + "value": "On logback-classic, critical severity resolved solely via absence-of-execution over the observation window." } ] }, @@ -8934,7 +8934,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: high-severity CVE, duration-only justification." + "value": "On logback-classic, high severity resting only on duration reasoning." } ] }, @@ -9048,7 +9048,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-core: medium severity accepted on duration alone, acceptable." + "value": "Medium severity; duration-based acceptance reasonable at this level." } ] }, @@ -9160,7 +9160,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-core: unscored severity, duration acceptance is low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -9272,7 +9272,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-core: unscored severity, low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -9384,7 +9384,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-core: unscored severity, low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -9496,7 +9496,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-core: unscored severity, low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -9608,7 +9608,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-core: unscored severity, low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -9720,7 +9720,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-core: unscored severity, low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -9834,7 +9834,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-web: critical severity with elevated EPSS (0.32), resolved purely on duration." + "value": "Critical severity spring-web CVE resolved solely by absence-of-execution despite active library usage." } ] }, @@ -9948,7 +9948,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-web: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on duration reasoning." } ] }, @@ -10062,7 +10062,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-web: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -10176,7 +10176,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-web: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on elapsed monitoring time." } ] }, @@ -10290,7 +10290,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-web: medium severity accepted on duration alone, acceptable." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -10404,7 +10404,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-context: medium severity, duration acceptance is fine - distinct component from the spring-web finding above with the same CVE ID." + "value": "Medium severity; duration-based acceptance reasonable here (spring-context instance)." } ] }, @@ -10518,7 +10518,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-web: medium severity accepted on duration alone, acceptable." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -10632,7 +10632,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-beans: critical severity AND KEV (Spring4Shell), resolved purely on duration with the library actively used (202/408 classes)." + "value": "On spring-beans, KEV critical Spring4Shell resolved by duration alone rather than structural non-reachability, despite active library usage." } ] }, @@ -10746,7 +10746,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-webmvc: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on elapsed monitoring time." } ] }, @@ -10860,7 +10860,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-webmvc: high-severity CVE with elevated EPSS (0.55), duration-only justification." + "value": "High severity CVE with elevated EPSS (98.9th percentile) resolved only by duration." } ] }, @@ -10974,7 +10974,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-webmvc: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -11088,7 +11088,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-webmvc: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -11202,7 +11202,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-webmvc: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -11316,7 +11316,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-webmvc: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -11430,7 +11430,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-webmvc: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -11544,7 +11544,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-webmvc: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -11658,7 +11658,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-webmvc: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -11772,7 +11772,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-webmvc: low severity, duration acceptance is fine." + "value": "Low severity; duration-based acceptance is low-stakes." } ] }, @@ -11886,7 +11886,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: critical-severity CVE, duration-only justification." + "value": "On logback-classic, critical severity resolved solely via absence-of-execution over the observation window." } ] }, @@ -12000,7 +12000,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "logback-classic: high-severity CVE, duration-only justification." + "value": "On logback-classic, high severity resting only on duration reasoning." } ] }, @@ -12114,7 +12114,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-beans: critical severity AND KEV (Spring4Shell), resolved purely on duration with the library actively used (202/408 classes)." + "value": "On spring-beans, KEV critical Spring4Shell resolved by duration alone rather than structural non-reachability, despite active library usage." } ] }, @@ -12228,7 +12228,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-beans: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -12342,7 +12342,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: critical-severity CVE, duration-only justification." + "value": "Critical severity tomcat-embed-core CVE resolved solely on absence-of-execution grounds." } ] }, @@ -12456,7 +12456,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: critical severity AND KEV (actively exploited), resolved purely on duration - highest-stakes combination flagged." + "value": "KEV-listed critical CVE with EPSS near 1.0 resolved only by duration - a high-priority candidate for manual reachability verification given active exploitation in the wild." } ] }, @@ -12570,7 +12570,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: critical-severity CVE, duration-only justification." + "value": "Critical severity claim resting solely on elapsed monitoring time." } ] }, @@ -12684,7 +12684,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: critical CVE correctly left in_triage since CVE Shield has no coverage at all - no active backstop and no structural guarantee, worth surfacing rather than letting sit." + "value": "Critical severity, in_triage with no CVE Shield coverage - correctly left open, but a high-priority unresolved item." } ] }, @@ -12798,7 +12798,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: critical severity AND KEV (Ghostcat, actively exploited), resolved purely on duration - flagged combination." + "value": "KEV-listed critical CVE (Ghostcat) with EPSS 0.99 resolved only by duration - warrants manual verification given active exploitation history." } ] }, @@ -12912,7 +12912,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: critical-severity CVE, duration-only justification." + "value": "Critical severity claim resting solely on absence-of-execution." } ] }, @@ -13026,7 +13026,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: critical CVE with elevated EPSS (0.44), duration-only justification." + "value": "Critical severity CVE with elevated EPSS (98.7th percentile) resolved only by duration." } ] }, @@ -13140,7 +13140,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: critical-severity CVE, duration-only justification." + "value": "Critical severity claim resting solely on elapsed monitoring time." } ] }, @@ -13254,7 +13254,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: critical CVE correctly left in_triage since CVE Shield has no coverage at all - no active backstop, worth surfacing." + "value": "Critical severity, in_triage with no CVE Shield coverage - open, high-priority item to track." } ] }, @@ -13368,7 +13368,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE with EPSS 1.0 (near-certain exploitation likelihood), resolved purely on duration." + "value": "High severity CVE with EPSS near 1.0 resolved solely on absence-of-execution." } ] }, @@ -13482,7 +13482,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high severity, KEV, and EPSS 1.0 - resolved purely on duration; among the strongest cases to double-check." + "value": "KEV-listed high severity CVE with EPSS near 1.0 resolved only by duration - warrants manual verification given confirmed exploitation." } ] }, @@ -13596,7 +13596,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high severity with EPSS 0.73, duration-only justification." + "value": "High severity CVE with elevated EPSS (99.4th percentile) resolved solely by duration." } ] }, @@ -13710,7 +13710,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on elapsed monitoring time." } ] }, @@ -13824,7 +13824,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -13938,7 +13938,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on absence-of-execution." } ] }, @@ -14052,7 +14052,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high severity with EPSS 0.67, duration-only justification." + "value": "High severity CVE with elevated EPSS (99.2nd percentile) resolved only by duration." } ] }, @@ -14166,7 +14166,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -14280,7 +14280,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high severity with EPSS 0.73, duration-only justification." + "value": "High severity CVE with elevated EPSS (99.4th percentile) resolved solely by duration." } ] }, @@ -14394,7 +14394,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on elapsed monitoring time." } ] }, @@ -14508,7 +14508,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -14622,7 +14622,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on absence-of-execution." } ] }, @@ -14736,7 +14736,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high severity with EPSS 0.57, duration-only justification." + "value": "High severity CVE with elevated EPSS (99th percentile) resolved only by duration." } ] }, @@ -14850,7 +14850,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -14964,7 +14964,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on elapsed monitoring time." } ] }, @@ -15078,7 +15078,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -15192,7 +15192,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on absence-of-execution." } ] }, @@ -15306,7 +15306,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -15420,7 +15420,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high severity with EPSS 0.6, duration-only justification." + "value": "High severity CVE with elevated EPSS (99th percentile) resolved only by duration." } ] }, @@ -15534,7 +15534,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE with EPSS 0.27, correctly left in_triage since Shield has no coverage - no backstop, worth surfacing." + "value": "High severity, in_triage with no CVE Shield coverage - open item needing verification, elevated EPSS (97.9th percentile)." } ] }, @@ -15648,7 +15648,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high severity with EPSS 0.23, duration-only justification." + "value": "High severity CVE with elevated EPSS (97.6th percentile) resolved only by duration." } ] }, @@ -15762,7 +15762,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE correctly left in_triage since Shield has no coverage - no backstop, worth surfacing." + "value": "High severity, in_triage with no CVE Shield coverage - open item to track." } ] }, @@ -15876,7 +15876,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high severity, KEV (HTTP/2 Rapid Reset, actively exploited), EPSS 1.0, resolved purely on duration - among the strongest cases to double-check." + "value": "KEV-listed high severity CVE (HTTP/2 Rapid Reset) with EPSS at 100th percentile resolved only by duration - a priority candidate for manual verification." } ] }, @@ -15990,7 +15990,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity CVE with elevated EPSS (97.3th percentile) resolved solely by duration." } ] }, @@ -16104,7 +16104,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE correctly left in_triage since Shield has no coverage - no backstop, worth surfacing." + "value": "High severity, in_triage with no CVE Shield coverage - open item to track." } ] }, @@ -16218,7 +16218,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on elapsed monitoring time." } ] }, @@ -16332,7 +16332,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -16446,7 +16446,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on absence-of-execution." } ] }, @@ -16560,7 +16560,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: high severity with EPSS 0.57, duration-only justification." + "value": "High severity CVE with elevated EPSS (99th percentile) resolved only by duration." } ] }, @@ -16674,7 +16674,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -16784,11 +16784,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." + "value": "Medium severity, in_triage with no CVE Shield coverage - correctly left open, worth tracking." } ] }, @@ -16902,7 +16902,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity, duration acceptance is fine despite elevated EPSS." + "value": "Medium severity; duration-based acceptance reasonable despite elevated EPSS." } ] }, @@ -17016,7 +17016,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -17130,7 +17130,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -17244,7 +17244,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -17358,7 +17358,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -17472,7 +17472,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -17586,7 +17586,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -17696,11 +17696,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." + "value": "Medium severity, in_triage with no CVE Shield coverage - open item worth tracking." } ] }, @@ -17810,11 +17810,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." + "value": "Medium severity, in_triage with no CVE Shield coverage - open item worth tracking." } ] }, @@ -17928,7 +17928,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: medium severity, duration acceptance is fine despite high EPSS (0.94), lower stakes than critical/high." + "value": "Medium severity; duration-based acceptance reasonable despite high EPSS." } ] }, @@ -18038,11 +18038,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-core: low severity correctly left in_triage with no Shield coverage; acceptable to leave open." + "value": "Low severity but in_triage with no CVE Shield coverage - correctly left open rather than closed." } ] }, @@ -18154,7 +18154,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "plexus-utils: code_not_reachable (0 of 102 classes), structural fact regardless of critical severity." + "value": "code_not_reachable structural claim, safe as-is despite critical severity." } ] }, @@ -18266,7 +18266,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "plexus-utils: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -18378,7 +18378,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "plexus-utils: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -18490,7 +18490,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "plexus-utils: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -18602,7 +18602,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "netty: code_not_reachable (0 of 727 classes), structural fact regardless of critical severity." + "value": "code_not_reachable structural claim, safe as-is despite critical severity." } ] }, @@ -18714,7 +18714,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "netty: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is despite critical severity." } ] }, @@ -18826,7 +18826,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "netty: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -18938,7 +18938,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "netty: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -19050,7 +19050,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "netty: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -19162,7 +19162,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "netty: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -19274,7 +19274,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "netty: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -19386,7 +19386,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "netty: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -19498,7 +19498,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "netty: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -19608,7 +19608,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "netty: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -19720,7 +19720,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jetty-http: code_not_reachable (0 of 81 classes), structural fact regardless of critical severity." + "value": "code_not_reachable structural claim, safe as-is despite critical severity." } ] }, @@ -19832,7 +19832,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jetty-http: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -19944,7 +19944,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jetty-http: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -20056,7 +20056,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jetty-http: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -20168,7 +20168,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jetty-http: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -20282,7 +20282,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "thymeleaf: critical-severity CVE resolved purely on duration despite heavy library usage (367/549 classes)." + "value": "Critical severity thymeleaf CVE resolved solely on absence-of-execution despite heavy library usage (367 of 549 classes)." } ] }, @@ -20396,7 +20396,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "thymeleaf: critical-severity CVE, duration-only justification." + "value": "Critical severity claim resting only on elapsed monitoring time." } ] }, @@ -20510,7 +20510,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "thymeleaf: critical-severity CVE, duration-only justification." + "value": "Critical severity claim resting only on elapsed monitoring time." } ] }, @@ -20624,7 +20624,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "mysql-connector-java: high-severity CVE, duration-only justification." + "value": "High severity mysql-connector-java CVE resolved solely by duration." } ] }, @@ -20738,7 +20738,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "mysql-connector-java: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on absence-of-execution." } ] }, @@ -20852,7 +20852,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "mysql-connector-java: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -20964,7 +20964,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "mysql-connector-java: unscored severity, low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] }, @@ -21076,7 +21076,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-boot-starter-actuator: code_not_reachable with 0 of 0 total classes - aggregator artifact with no classes of its own, trivially valid." + "value": "code_not_reachable structural claim, safe as-is despite high severity." } ] }, @@ -21190,7 +21190,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-boot: high-severity CVE, duration-only justification." + "value": "High severity spring-boot CVE resolved solely on absence-of-execution." } ] }, @@ -21304,7 +21304,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-boot: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on elapsed monitoring time." } ] }, @@ -21418,7 +21418,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-boot: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -21532,7 +21532,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-boot: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -21644,7 +21644,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "neko-htmlunit: code_not_reachable (0 of 53 classes) - structural fact even though Shield has no coverage for this one, since reachability is not probabilistic." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -21756,7 +21756,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "neko-htmlunit: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -21870,7 +21870,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "gson: high-severity CVE, duration-only justification despite partial library usage (36/174 classes)." + "value": "High severity gson CVE resolved solely by duration despite active library usage." } ] }, @@ -21982,7 +21982,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-compress: code_not_reachable (0 of 200 classes), structural fact regardless of high severity." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -22094,7 +22094,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-compress: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -22206,7 +22206,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-compress: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -22318,7 +22318,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-compress: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -22430,7 +22430,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-compress: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -22542,7 +22542,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-compress: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -22656,7 +22656,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "xalan: high-severity CVE with high EPSS (0.81), resolved on duration alone though library barely used (7/1501 classes) - not code_not_reachable, so still absence-of-execution." + "value": "High severity xalan CVE with a notably high EPSS (99.6th percentile) resolved solely on duration despite active library usage." } ] }, @@ -22770,7 +22770,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-core: high-severity CVE, duration-only justification." + "value": "High severity spring-core CVE resolved solely on absence-of-execution." } ] }, @@ -22884,7 +22884,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-core: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on elapsed monitoring time." } ] }, @@ -22998,7 +22998,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-core: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -23112,7 +23112,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-core: high-severity CVE, duration-only justification." + "value": "High severity claim resting solely on absence-of-execution." } ] }, @@ -23226,7 +23226,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -23340,7 +23340,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-core: medium severity, duration acceptance is fine despite elevated EPSS (0.35)." + "value": "Medium severity; duration-based acceptance reasonable despite elevated EPSS." } ] }, @@ -23454,7 +23454,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -23568,7 +23568,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -23682,7 +23682,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-expression: high-severity CVE, duration-only justification." + "value": "High severity spring-expression CVE resolved solely on absence-of-execution." } ] }, @@ -23796,7 +23796,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-expression: high-severity CVE, duration-only justification." + "value": "High severity claim resting only on elapsed monitoring time." } ] }, @@ -23910,7 +23910,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-expression: high-severity CVE, duration-only justification." + "value": "High severity, duration-only justification." } ] }, @@ -24024,7 +24024,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-expression: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -24138,7 +24138,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-expression: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -24252,7 +24252,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-expression: medium severity, duration acceptance is fine despite elevated EPSS (0.36)." + "value": "Medium severity; duration-based acceptance reasonable despite elevated EPSS." } ] }, @@ -24366,7 +24366,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-expression: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -24480,7 +24480,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-expression: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -24594,7 +24594,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-boot-autoconfigure: high-severity CVE, duration-only justification." + "value": "High severity spring-boot-autoconfigure CVE resolved solely on absence-of-execution." } ] }, @@ -24708,7 +24708,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-websocket: high severity with EPSS 0.87 (near-certain exploitation likelihood), correctly left in_triage since Shield has no coverage - no backstop, this is the highest-priority in_triage item to review." + "value": "High severity, in_triage with no CVE Shield coverage and a very high EPSS (99.7th percentile) - a priority open item to verify." } ] }, @@ -24822,7 +24822,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "tomcat-embed-websocket: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -24936,7 +24936,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "hibernate-core: high-severity CVE, duration-only justification despite heavy library usage (1563/3787 classes)." + "value": "High severity hibernate-core CVE resolved solely by duration despite very heavy library usage (1563 of 3787 classes)." } ] }, @@ -25050,7 +25050,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "hibernate-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -25164,7 +25164,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "hibernate-validator: high-severity CVE correctly left in_triage since Shield has no coverage - no backstop, worth surfacing." + "value": "High severity, in_triage with no CVE Shield coverage - open item requiring verification." } ] }, @@ -25278,7 +25278,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "hibernate-validator: high-severity CVE, duration-only justification." + "value": "High severity hibernate-validator CVE resolved solely by duration." } ] }, @@ -25388,11 +25388,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "hibernate-validator: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." + "value": "Medium severity, in_triage with no CVE Shield coverage - open item worth tracking." } ] }, @@ -25502,11 +25502,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "hibernate-validator: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." + "value": "Medium severity, in_triage with no CVE Shield coverage - open item worth tracking." } ] }, @@ -25620,7 +25620,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "guava: high-severity CVE, duration-only justification (5/1717 classes used, not code_not_reachable)." + "value": "High severity guava CVE resolved solely by duration despite active library usage." } ] }, @@ -25730,11 +25730,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "guava: medium severity correctly left in_triage with no Shield coverage; low enough stakes to leave open." + "value": "Medium severity, in_triage with no CVE Shield coverage - open item worth tracking." } ] }, @@ -25848,7 +25848,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "guava: low severity, duration acceptance is fine." + "value": "Low severity; duration-based acceptance is low-stakes." } ] }, @@ -25960,7 +25960,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "xercesimpl: unscored severity, duration acceptance is low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance despite elevated EPSS." } ] }, @@ -26072,7 +26072,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "xercesimpl: unscored severity, low stakes despite elevated EPSS." + "value": "Unscored severity; low stakes for duration-based acceptance despite elevated EPSS." } ] }, @@ -26186,7 +26186,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "xercesimpl: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -26300,7 +26300,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "xercesimpl: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -26414,7 +26414,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-boot-actuator: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -26526,7 +26526,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "bootstrap (webjar): code_not_reachable with 0 of 0 classes - a JS-only webjar has no Java classes to load, so this is trivially and structurally valid." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -26638,7 +26638,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "bootstrap (webjar): code_not_reachable, structural fact for a JS-only artifact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -26750,7 +26750,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "bootstrap (webjar): code_not_reachable, structural fact for a JS-only artifact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -26862,7 +26862,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "bootstrap (webjar): code_not_reachable, structural fact for a JS-only artifact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -26974,7 +26974,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "bootstrap (webjar): code_not_reachable, structural fact for a JS-only artifact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -27086,7 +27086,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "bootstrap (webjar): code_not_reachable, structural fact for a JS-only artifact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -27198,7 +27198,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "junit: code_not_reachable (0 of 286 classes), a test-scope library that\u0027s plausibly never loaded at runtime - structurally sound." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -27310,7 +27310,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-lang3: code_not_reachable (0 of 152 classes), structural fact - distinct component from the commons-lang finding above with the same CVE ID." + "value": "code_not_reachable structural claim on commons-lang3, safe as-is (same CVE affecting a second library, separately verified as unreachable)." } ] }, @@ -27422,7 +27422,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-lang3: code_not_reachable (0 of 152 classes), structural fact - distinct component from the commons-lang finding above with the same CVE ID." + "value": "code_not_reachable structural claim on commons-lang3, safe as-is (same CVE affecting a second library, separately verified as unreachable)." } ] }, @@ -27536,7 +27536,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-data-jpa: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -27650,7 +27650,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-data-jpa: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -27764,7 +27764,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-context: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -27878,7 +27878,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-context: medium severity, duration acceptance is fine - distinct component from the spring-web finding above with the same CVE ID." + "value": "Medium severity; duration-based acceptance reasonable here (spring-context instance)." } ] }, @@ -27992,7 +27992,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "spring-context: low severity, duration acceptance is fine." + "value": "Low severity; duration-based acceptance is low-stakes." } ] }, @@ -28104,7 +28104,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "httpclient: code_not_reachable (0 of 466 classes), structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -28216,7 +28216,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-io: code_not_reachable (0 of 110 classes) - structural fact independent of the fact that Shield has no coverage here." + "value": "code_not_reachable structural claim; Shield coverage is irrelevant here since the justification is structural, not duration-based." } ] }, @@ -28328,7 +28328,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "commons-io: code_not_reachable, structural fact." + "value": "code_not_reachable structural claim, safe as-is." } ] }, @@ -28442,7 +28442,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-core: medium severity, duration acceptance is fine." + "value": "Medium severity; duration-based acceptance reasonable here." } ] }, @@ -28554,7 +28554,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "jackson-core: unscored severity, low stakes." + "value": "Unscored severity; low stakes for duration-based acceptance." } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index 4ac3164..94f2fe2 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -569,12 +569,13 @@ private String generateReport(List appResults, List entrie .append("considered: `Yes` (Shield exists there, even if it hasn't fired), `No` (no Shield coverage for ") .append("this CVE at all - the claim rests entirely on absence-of-execution, with no possible active ") .append("backstop), `-` (no signal either way).\n\n"); - sb.append("**Rationale** - why the claim was made, with the day count for the two duration-based reasons:\n\n"); + sb.append("**Rationale** - why the claim was made, with the day count for the three duration-based reasons:\n\n"); sb.append("| Rationale | Meaning |\n|-----------|---------|\n"); sb.append("| `Library Unused` | Library never loaded at runtime (0 classes) - structural, not time-based |\n"); sb.append("| `CVE Shielded` | CVE Shield actively mitigating at runtime - an active control, not time-based |\n"); sb.append("| `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold |\n"); - sb.append("| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold |\n\n"); + sb.append("| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold - may still graduate to `CVE Not Used` |\n"); + sb.append("| `No Shield Coverage Nd` | in_triage, permanently - CVE Shield has no coverage for this CVE here (Shield column is `No`), so elapsed time is never evidence of anything and this can never graduate, no matter how large Nd gets |\n\n"); sb.append("Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth ") .append("a second look surface at the top - see the Key Findings above for which specific CVEs those are.\n\n"); sb.append("**Protection Status** (shown per app below) - Assess is the module that produces the runtime ") @@ -654,10 +655,19 @@ private String generateReport(List appResults, List entrie return sb.toString(); } - /** Library Unused/CVE Shielded are structural; CVE Not Used/CVE Watching are duration-based and carry the day count. */ + /** + * Library Unused/CVE Shielded are structural. CVE Not Used/CVE Watching are duration-based and genuinely + * still accumulating toward (or past) the acceptance threshold. No Shield Coverage is also in_triage, but + * for a different reason - Shield has zero coverage for this CVE, so it stays in_triage forever regardless + * of daysObserved; using "CVE Watching Nd" for that case would make a 288-day-old in_triage claim look like + * a bug rather than the intended "can never graduate" state. + */ private String rationaleWord(VexStatement s) { if ("code_not_reachable".equals(s.justification)) return "Library Unused"; if ("protected_at_runtime".equals(s.justification)) return "CVE Shielded"; + if ("in_triage".equals(s.state) && Boolean.FALSE.equals(s.shieldAvailable)) { + return "No Shield Coverage " + s.daysObserved + "d"; + } if ("in_triage".equals(s.state)) return "CVE Watching " + s.daysObserved + "d"; return "CVE Not Used " + s.daysObserved + "d"; } From e08e249e01baf41f75c384fb5e8daa9890b8da90 Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Wed, 2 Sep 2026 23:50:53 -0400 Subject: [PATCH 15/16] Simplify shieldAvailability to the org-wide fact, drop per-env inference CVE Shield coverage is a per-CVE, product-level fact (does Contrast ship a virtual patch for this CVE at all) - not something that varies by app or environment. If Shield covers a CVE anywhere, it's available everywhere Shield/ADR is enabled. The previous shieldAvailability() tried to infer availability from per-app NO_SHIELD/NOT_SEEN status, falling back to the org-wide cveShieldExists flag only when there was no per-app signal - solving the wrong problem, since that per-app status can't distinguish "no coverage exists" from other per-agent gaps, and coverage itself isn't app/environment-scoped to begin with. Simplified: shieldAvailability() is now just the org-wide cveShieldExists flag from /organizations/{org}/cves, verbatim. Verified this doesn't change any current results (checked - zero cases in the sample data where NO_SHIELD and a real status like NOT_SEEN appeared together for the same CVE across environments, consistent with the per-CVE model), but it's the conceptually correct source of truth and removes a heuristic that could misfire on data this session never happened to exercise (e.g. a per-app join gap that isn't actually a coverage gap). Updated wording throughout (VEXAdvisor prompt, Legend, formatAppForAi, README) to stop describing Shield availability as environment-scoped. Regenerated samples/sample-vex.json and sample-vex-advisor.md; re-validated against the CycloneDX 1.6 schema. --- README.md | 8 +- samples/sample-vex-advisor.md | 14 +- samples/sample-vex.json | 716 +++++++++--------- .../runtimeanalyst/VEXAdvisor.java | 20 +- .../runtimeanalyst/VEXGenerator.java | 59 +- 5 files changed, 406 insertions(+), 411 deletions(-) diff --git a/README.md b/README.md index e1cf037..22399c7 100644 --- a/README.md +++ b/README.md @@ -140,9 +140,9 @@ By default a claim considers the application's dev/qa/prod environments together → `not_affected` / `protected_at_runtime`. 3. **Library loaded, and this application's CVE status is `EXPOSED`/`EXPLOITED`** → no VEX statement at all. This tool never suppresses a vulnerability it can't positively account for. -4. **Library loaded, but the CVE has never been observed executing in this application** - a statement is still generated, but *what* it claims depends on whether CVE Shield exists there at all (`NO_SHIELD`, a real per-environment status distinct from `NOT_SEEN`, confirmed by scanning every application in the org): - - Shield exists and simply hasn't fired (`NOT_SEEN`) → `not_affected` once days observed clears the acceptance threshold, `in_triage` until then - elapsed time is meaningful evidence here, because something was watching. - - Shield has **no coverage at all** for that CVE (`NO_SHIELD` in every environment considered) → `in_triage`, permanently, regardless of days observed. Elapsed time can't turn "no detector was watching" into "nothing happened" - this can never graduate to `not_affected` on duration alone. Earlier versions of this tool either silently dropped these CVEs entirely, or (briefly, mid-development) marked them `not_affected` anyway once enough days had passed - both were bugs, not policy choices. +4. **Library loaded, but the CVE has never been observed executing in this application** - a statement is still generated, but *what* it claims depends on whether CVE Shield has a virtual patch for that CVE at all. This is a per-CVE, product-level fact (`cveShieldExists` on the org-wide `/organizations/{org}/cves` endpoint) - not an app- or environment-scoped one, since coverage existing anywhere means it's available everywhere Shield/ADR is enabled: + - Shield covers this CVE and simply hasn't fired → `not_affected` once days observed clears the acceptance threshold, `in_triage` until then - elapsed time is meaningful evidence here, because something was watching. + - Shield has **no coverage at all** for that CVE → `in_triage`, permanently, regardless of days observed. Elapsed time can't turn "no detector was watching" into "nothing happened" - this can never graduate to `not_affected` on duration alone. Earlier versions of this tool tried three different wrong things here: silently dropping these CVEs entirely, marking them `not_affected` anyway once enough days had passed, and inferring "coverage" from a per-app/per-environment `NO_SHIELD` status instead of the org-wide fact - all three were bugs, not policy choices. Every statement carries `contrast:*` properties (`classesUsed`/`classCount`, `daysObserved`, `acceptAfterDays`, `envFilter`, and the per-environment `devStatus`/`qaStatus`/`prodStatus`) so a reviewer can see the underlying evidence, not just the resulting state. @@ -209,7 +209,7 @@ A standard CycloneDX 1.6 document with a top-level `vulnerabilities[]` array, on All of the above is deterministic, pulled directly from Contrast's own CVE/library data - nothing here is AI-generated, since a VEX claim is an attestation and needs to stay auditable back to its source evidence. The EPSS/CISA KEV/Shield-availability signals are new inputs to the **VEX Advisor**'s AI judgment (below), not to the claim itself. -`contrast:shieldAvailable` prefers a real, app-scoped signal: Contrast's per-application `cves/issues` endpoint returns a `NO_SHIELD` status (distinct from `NOT_SEEN`, confirmed by scanning every application in this org) meaning CVE Shield has no coverage for that CVE in that environment at all. When there's no per-app signal either way, it falls back to the org-wide `cveShieldExists` flag from `/organizations/{org}/cves`. This isn't just informational - it changes which state a claim can reach (see policy rule 4 above): when Shield has no coverage, the claim stays `in_triage` forever, since elapsed time without a detector watching is not evidence of anything. +`contrast:shieldAvailable` is the org-wide `cveShieldExists` flag from `/organizations/{org}/cves`, verbatim - whether Contrast has a virtual patch definition for this CVE at all, a per-CVE product-level fact rather than something that could differ between environments. (An earlier version of this tool tried to infer it from the per-application `cves/issues` endpoint's `NO_SHIELD` status per environment instead - that status is real and does show up per-app/per-env, but coverage itself isn't scoped that way, so the org-wide fact is authoritative.) This isn't just informational - it changes which state a claim can reach (see policy rule 4 above): when Shield has no coverage, the claim stays `in_triage` forever, since elapsed time without a detector watching is not evidence of anything. The document also has a top-level `components[]` array with one Application component per app, carrying whether Assess (the module that produces every claim's runtime evidence) and ADR (the classic HTTP-rule-based RASP module, formerly branded "Protect" - a different, older product from CVE Shield) are enabled per environment: `contrast:assessEnabledDev`/`Qa`/`Prod` and `contrast:adrEnabledDev`/`Qa`/`Prod` (`"true"`/`"false"`/`""` - empty means no agent was ever seen reporting from that environment, which is a different fact from "disabled"). diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index b25061b..a73606e 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -18,9 +18,9 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated **Key Findings:** -- **141 of 251 claim(s) flagged for human review** before relying on them. +- **37 of 251 claim(s) flagged for human review** before relying on them. - **8 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. -- **11 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+5 more). +- **12 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+6 more). - Application(s) rated CRITICAL/HIGH risk: SAML-PetClinic-Demo. ### Applications @@ -37,7 +37,7 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated **VEX** - `NA` = not_affected, `IT` = in_triage -**Shield** - whether CVE Shield could catch this specific CVE at all in the environment(s) considered: `Yes` (Shield exists there, even if it hasn't fired), `No` (no Shield coverage for this CVE at all - the claim rests entirely on absence-of-execution, with no possible active backstop), `-` (no signal either way). +**Shield** - whether CVE Shield has a virtual patch for this specific CVE at all (a per-CVE, product-level fact - coverage existing anywhere means it's available everywhere Shield is enabled): `Yes` (Shield covers it, even if it hasn't fired), `No` (no Shield coverage for this CVE at all - the claim rests entirely on absence-of-execution, with no possible active backstop), `-` (unknown). **Rationale** - why the claim was made, with the day count for the three duration-based reasons: @@ -51,7 +51,7 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth a second look surface at the top - see the Key Findings above for which specific CVEs those are. -**Protection Status** (shown per app below) - Assess is the module that produces the runtime evidence every claim in this report rests on; ADR (formerly branded "Protect") is the classic HTTP-rule-based RASP module. Neither is CVE Shield - CVE Shield is a separate product that defends specific CVEs via a microsandbox rather than HTTP rules. Its own coverage is the per-row **Shield** column above, sourced from the real per-app, per-environment NO_SHIELD/NOT_SEEN signal where available. +**Protection Status** (shown per app below) - Assess is the module that produces the runtime evidence every claim in this report rests on; ADR (formerly branded "Protect") is the classic HTTP-rule-based RASP module. Neither is CVE Shield - CVE Shield is a separate product that defends specific CVEs via a microsandbox rather than HTTP rules. Its own coverage is the per-row **Shield** column above - a per-CVE, product-level fact (coverage existing anywhere means it's available everywhere Shield is enabled), not an app- or environment-scoped one. --- @@ -63,11 +63,11 @@ Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, s **Protection Status:** Assess (runtime evidence): dev=enabled, qa=no data, prod=enabled · ADR (classic RASP, formerly "Protect" - not CVE Shield): dev=disabled, qa=no data, prod=enabled -SAML-PetClinic-Demo has roughly 210 VEX claims across ~40 vulnerable libraries (jackson-databind, tomcat-embed-core, spring-webmvc/web/beans/core/expression, spring-data-commons, hibernate, netty, snakeyaml, dom4j, guava, and others). Assess has real runtime data in dev and prod (qa has none), and ADR is active in prod but off in dev. A large minority of claims are code_not_reachable (structural, sound), but a much larger share are 'not_affected' resting solely on 288 days of no-observed-execution, including several critical/KEV CVEs (Spring4Shell CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487) and a long tail of critical/high tomcat-embed-core and jackson-databind CVEs. +SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominated by a long tail of jackson-databind and tomcat-embed-core CVEs. The large majority are either structurally sound (code_not_reachable, zero classes loaded) or duration-based claims on low-EPSS CVEs backed by 288 days of Assess data from dev and prod, with Shield coverage and prod ADR as an active backstop. A meaningful subset, however, rests on duration alone for CVEs with very high EPSS or CISA KEV status, including three separate Spring4Shell (CVE-2022-22965) claims, Ghostcat (CVE-2020-1938), the Tomcat JSP-upload RCE (CVE-2017-12617), HTTP/2 Rapid Reset (CVE-2023-44487), and the 2025 Tomcat partial-PUT RCE (CVE-2025-24813). -**Risk Rationale:** The code_not_reachable claims (htmlunit, snakeyaml, netty, jetty-http, plexus-utils, commons-compress, junit, commons-lang/lang3, commons-io, bootstrap, spring-boot-starter-web/actuator) are structural and sound regardless of severity. However, a very large number of critical and high severity CVEs - including six KEV entries - are resolved to not_affected using duration-only reasoning (288 days vs a 30-day threshold) rather than code_not_reachable or an active CVE Shield mitigation. CVE Shield exists for most of these but has not necessarily fired, so the claim still rests primarily on absence-of-execution for internet-facing, high-EPSS libraries (tomcat-embed-core, jackson-databind, spring-webmvc, spring-data-commons). A smaller set of in_triage claims (mostly on tomcat-embed-core, hibernate-validator, guava) have no CVE Shield coverage at all, meaning there is no backstop if the reachability assumption is wrong. ADR being disabled in dev further reduces the safety net for any of these in that environment. +**Risk Rationale:** Most claims are well-supported, but a cluster of critical/high severity, actively-exploited (KEV or EPSS near 1.0) CVEs on spring-beans, spring-webmvc, spring-data-commons, and tomcat-embed-core are marked not_affected using only absence-of-execution reasoning, not code_not_reachable or protected_at_runtime. Given ADR is disabled in dev, any wrong call on these specific findings has no active backstop in that tier. Several tomcat-embed-core, hibernate-validator, and guava CVEs are also in_triage with zero CVE Shield coverage at all, meaning there is no active mitigation possible if the absence-of-execution assumption is wrong. -**Recommendation:** Prioritize a human reachability review for the KEV-listed critical CVEs (CVE-2022-22965 on spring-webmvc/spring-beans, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487) before relying on the VEX as-is, since these are actively exploited in the wild and currently rest on duration-only evidence. Also review the in_triage CVEs lacking CVE Shield coverage (tomcat-embed-core CVE-2026-41293/2025-66614/2020-11996/2026-24880/2026-42498/2023-45648/2020-1935/2026-43514, hibernate-validator CVE-2025-35036/2023-1932/2020-10693, guava CVE-2018-10237, jackson-databind CVE-2026-54515/2026-54514) since nothing would have caught an exploit attempt regardless of elapsed time. The code_not_reachable claims and the medium/low severity duration-based claims can be relied on without further review. +**Recommendation:** Have a human re-verify reachability (not just runtime absence) for the KEV-listed and EPSS-near-1.0 claims before trusting them, especially the three CVE-2022-22965 (Spring4Shell) instances, CVE-2020-1938 (Ghostcat), CVE-2017-12617, CVE-2023-44487, CVE-2025-24813, and CVE-2018-1273. Also prioritize the tomcat-embed-core, hibernate-validator, and guava CVEs currently in_triage with no CVE Shield coverage, since those have no possible active backstop today. | CVE | Library | Score | VEX | Shield | Rationale | |-----|---------|-------|-----|--------|-----------| diff --git a/samples/sample-vex.json b/samples/sample-vex.json index 0eba04f..bf25a0c 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -3,7 +3,7 @@ "specVersion": "1.6", "version": 1, "metadata": { - "timestamp": "2026-09-03T02:53:20Z", + "timestamp": "2026-09-03T03:38:50Z", "component": { "type": "application", "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", @@ -176,11 +176,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity jackson-databind CVE resolved to not_affected on 288 days of no execution alone; CVE Shield exists but hasn\u0027t necessarily fired, so this rests on absence-of-evidence for a critical RCE-class library." + "value": "Low EPSS (0.1), Shield coverage exists, 288 days well past threshold." } ] }, @@ -290,11 +290,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only reasoning pattern on a critical jackson-databind deserialization CVE; worth a reachability check before trusting fully." + "value": "Low EPSS (0.06), Shield coverage backstop present." } ] }, @@ -408,7 +408,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE with relatively high EPSS (98.8th percentile) resolved by duration alone rather than structural non-reachability." + "value": "Critical severity with elevated EPSS (0.5) accepted on duration alone, worth a second look." } ] }, @@ -522,7 +522,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, high EPSS percentile, resolved only via elapsed-time observation rather than code_not_reachable or an active Shield mitigation." + "value": "Critical severity with EPSS 0.27 relying solely on absence-of-execution." } ] }, @@ -632,11 +632,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical jackson-databind deserialization gadget CVE resting on duration-only reasoning." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -746,11 +746,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim based solely on absence of observed execution over 288 days." + "value": "Low EPSS (0.09), Shield coverage present." } ] }, @@ -860,11 +860,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Duration-only justification for a critical jackson-databind CVE; deserves a closer look given severity." + "value": "Low EPSS (0.13), Shield coverage present." } ] }, @@ -974,11 +974,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same pattern - critical severity resolved by elapsed time alone." + "value": "Low EPSS (0.08), Shield coverage present." } ] }, @@ -1088,11 +1088,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE, duration-based not_affected claim, worth verifying before relying on it." + "value": "Low EPSS (0.1), Shield coverage present." } ] }, @@ -1202,11 +1202,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity gadget-chain CVE resolved via absence-of-execution reasoning only." + "value": "EPSS 0.18, moderate, Shield backstop present." } ] }, @@ -1316,11 +1316,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Duration-only claim on a critical jackson-databind CVE." + "value": "Low EPSS (0.11), Shield coverage present." } ] }, @@ -1430,11 +1430,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, resolved solely by elapsed monitoring time rather than structural evidence." + "value": "EPSS 0.18, Shield backstop present." } ] }, @@ -1544,11 +1544,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE resting on duration-only reasoning; should be double-checked." + "value": "Low EPSS (0.06), Shield coverage present." } ] }, @@ -1658,11 +1658,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only pattern for a critical deserialization CVE." + "value": "Low EPSS (0.06), Shield coverage present." } ] }, @@ -1772,11 +1772,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim relying only on absence of observed execution." + "value": "Low EPSS (0.11), Shield coverage present." } ] }, @@ -1886,11 +1886,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Duration-only justification on a critical jackson-databind CVE." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -2000,11 +2000,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, resolved via elapsed time only, no code_not_reachable or Shield mitigation cited." + "value": "Low EPSS (0.11), Shield coverage present." } ] }, @@ -2114,11 +2114,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only pattern for a critical gadget CVE." + "value": "Low EPSS (0.11), Shield coverage present." } ] }, @@ -2228,11 +2228,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE resolved solely on absence-of-execution grounds." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -2346,7 +2346,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical CVE with a notably high EPSS (98.8th percentile) resolved only by duration; especially worth a second look given the exploitation likelihood." + "value": "Critical severity with notably high EPSS (0.38) resolved on duration alone." } ] }, @@ -2460,7 +2460,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim resting on elapsed-time reasoning alone." + "value": "Critical severity, EPSS 0.2, worth confirming before relying on absence-of-execution." } ] }, @@ -2570,11 +2570,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Duration-only not_affected claim on a critical CVE." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -2684,11 +2684,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE resolved via absence-of-execution only." + "value": "Low EPSS (0.08), Shield coverage present." } ] }, @@ -2798,11 +2798,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only pattern for a critical jackson-databind CVE." + "value": "Low EPSS (0.08), Shield coverage present." } ] }, @@ -2912,11 +2912,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE resolved solely by elapsed monitoring time rather than structural evidence." + "value": "Low EPSS (0.08), high severity but Shield backstop present." } ] }, @@ -3026,11 +3026,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS (0.13), Shield coverage present." } ] }, @@ -3140,11 +3140,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on absence of observed execution." + "value": "Low EPSS (0.09), Shield coverage present." } ] }, @@ -3254,11 +3254,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only pattern for a high severity jackson-databind CVE." + "value": "Low EPSS (0.08), Shield coverage present." } ] }, @@ -3368,11 +3368,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, resolved via elapsed time only." + "value": "Low EPSS (0.1), Shield coverage present." } ] }, @@ -3482,11 +3482,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Duration-only reasoning on a high severity CVE." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -3596,11 +3596,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on absence-of-execution." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -3710,11 +3710,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only pattern for a high severity CVE." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -3824,11 +3824,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -3942,7 +3942,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (97.4th percentile) resolved only by elapsed time." + "value": "High severity with EPSS 0.21 resolved purely on duration." } ] }, @@ -4052,11 +4052,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on absence-of-execution." + "value": "Very low EPSS (0.03), Shield coverage present." } ] }, @@ -4166,11 +4166,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only pattern for a high severity CVE." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -4280,11 +4280,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS (0.11), Shield coverage present." } ] }, @@ -4394,11 +4394,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on elapsed monitoring time." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -4508,11 +4508,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only pattern for a high severity CVE." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -4622,11 +4622,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, resolved via absence-of-execution only." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -4736,11 +4736,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on duration reasoning." + "value": "Low EPSS (0.07), Shield coverage present." } ] }, @@ -4850,11 +4850,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE resolved only by elapsed time." + "value": "Low EPSS (0.07), Shield coverage present." } ] }, @@ -4964,11 +4964,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS (0.09), Shield coverage present." } ] }, @@ -5078,11 +5078,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on absence-of-execution." + "value": "Low EPSS (0.07), Shield coverage present." } ] }, @@ -5192,11 +5192,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, resolved via elapsed time only, no structural or active-control evidence." + "value": "Very low EPSS (0.03), Shield coverage present." } ] }, @@ -5306,11 +5306,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only pattern for a high severity CVE." + "value": "Very low EPSS (0.03), Shield coverage present." } ] }, @@ -5420,11 +5420,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS resolved only by elapsed monitoring time." + "value": "EPSS 0.18, under review threshold, Shield backstop present." } ] }, @@ -5534,11 +5534,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS (0.09), Shield coverage present." } ] }, @@ -5648,11 +5648,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on absence-of-execution." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -5762,11 +5762,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE resolved only via elapsed time." + "value": "Low EPSS (0.11), Shield coverage present." } ] }, @@ -5876,11 +5876,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same duration-only pattern for a high severity CVE." + "value": "Low EPSS (0.07), Shield coverage present." } ] }, @@ -5994,7 +5994,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (97.5th percentile) resolved only by duration." + "value": "High severity with EPSS 0.22 accepted on duration alone." } ] }, @@ -6108,7 +6108,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-only acceptance is acceptable at this risk level even with a moderately high EPSS." + "value": "Medium severity, lower stakes even with EPSS 0.45." } ] }, @@ -6222,7 +6222,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity claim; duration-based acceptance is reasonable at this stakes level." + "value": "Medium severity, low EPSS (0.11)." } ] }, @@ -6332,11 +6332,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "In_triage with no CVE Shield coverage at all - correctly left open rather than closed, but flagged as an unresolved risk needing attention." + "value": "Correctly in_triage given no Shield coverage, but medium severity and negligible EPSS keep stakes low." } ] }, @@ -6446,11 +6446,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Same as above: in_triage, no Shield coverage, still an open item worth tracking." + "value": "Correctly in_triage given no Shield coverage, but medium severity and negligible EPSS keep stakes low." } ] }, @@ -6562,7 +6562,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable with 0 of 1295 classes loaded is a structural fact, safe to rely on regardless of critical severity." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -6674,7 +6674,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -6784,11 +6784,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity dom4j XXE/RCE CVE resolved by duration only despite the library being loaded (1 of 190 classes)." + "value": "Minimal class usage (1 of 190) and low EPSS, Shield backstop present." } ] }, @@ -6898,11 +6898,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification on a loaded library." + "value": "Minimal class usage and low EPSS, Shield backstop present." } ] }, @@ -7014,7 +7014,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable (0 of 206 classes) is a structural fact; despite the very high EPSS, the justification type is sound and not duration-based." + "value": "code_not_reachable, zero classes loaded, structural fact despite EPSS 1.0." } ] }, @@ -7126,7 +7126,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -7238,7 +7238,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -7350,7 +7350,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -7462,7 +7462,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -7574,7 +7574,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -7686,7 +7686,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -7798,7 +7798,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -7910,7 +7910,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "On spring-beans, KEV critical Spring4Shell resolved by duration alone rather than structural non-reachability, despite active library usage." + "value": "KEV-listed Spring4Shell with EPSS 1.0 resolved solely on absence-of-execution for spring-beans, not structural non-reachability." } ] }, @@ -8024,7 +8024,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed critical CVE with 97%+ EPSS resolved on duration alone despite the library being actively loaded (152 of 554 classes) - this is exactly the pattern that warrants human verification." + "value": "KEV-listed critical vulnerability with EPSS 0.97 resolved solely on absence-of-execution, not structural non-reachability." } ] }, @@ -8134,11 +8134,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on absence-of-execution." + "value": "Low EPSS (0.02), Shield coverage present." } ] }, @@ -8248,11 +8248,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE resolved only by elapsed monitoring time." + "value": "Negligible EPSS, Shield coverage present." } ] }, @@ -8366,7 +8366,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-only acceptance reasonable at this risk level." + "value": "Medium severity, negligible EPSS." } ] }, @@ -8480,7 +8480,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-only acceptance reasonable at this risk level." + "value": "Medium severity, negligible EPSS." } ] }, @@ -8592,7 +8592,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored/unknown severity; duration-based acceptance is low-stakes here." + "value": "Unknown severity, low EPSS, Shield backstop present." } ] }, @@ -8702,11 +8702,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity hsqldb CVE resolved only by absence-of-execution over the observation window." + "value": "Low EPSS (0.04), Shield coverage present." } ] }, @@ -8816,11 +8816,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "On logback-classic, critical severity resolved solely via absence-of-execution over the observation window." + "value": "Low EPSS (0.08), Shield coverage present, logback-classic instance." } ] }, @@ -8930,11 +8930,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "On logback-classic, high severity resting only on duration reasoning." + "value": "Very low EPSS (0.01), Shield coverage present, logback-classic instance." } ] }, @@ -9048,7 +9048,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable at this level." + "value": "Medium severity, low EPSS." } ] }, @@ -9160,7 +9160,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unknown severity, negligible EPSS." } ] }, @@ -9272,7 +9272,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unknown severity, negligible EPSS." } ] }, @@ -9384,7 +9384,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unknown severity, negligible EPSS." } ] }, @@ -9496,7 +9496,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unknown severity, negligible EPSS." } ] }, @@ -9608,7 +9608,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unknown severity, negligible EPSS." } ] }, @@ -9720,7 +9720,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unknown severity, negligible EPSS." } ] }, @@ -9834,7 +9834,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity spring-web CVE resolved solely by absence-of-execution despite active library usage." + "value": "Critical severity with EPSS 0.32 accepted on duration alone." } ] }, @@ -9944,11 +9944,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on duration reasoning." + "value": "Low EPSS (0.04), Shield coverage present." } ] }, @@ -10058,11 +10058,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Very low EPSS (0.01), Shield coverage present." } ] }, @@ -10172,11 +10172,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on elapsed monitoring time." + "value": "Low EPSS (0.03), Shield coverage present." } ] }, @@ -10290,7 +10290,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -10404,7 +10404,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here (spring-context instance)." + "value": "Medium severity, low EPSS, spring-context instance." } ] }, @@ -10518,7 +10518,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -10632,7 +10632,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "On spring-beans, KEV critical Spring4Shell resolved by duration alone rather than structural non-reachability, despite active library usage." + "value": "KEV-listed Spring4Shell with EPSS 1.0 resolved solely on absence-of-execution for spring-beans, not structural non-reachability." } ] }, @@ -10742,11 +10742,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on elapsed monitoring time." + "value": "Negligible EPSS, Shield coverage present." } ] }, @@ -10860,7 +10860,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (98.9th percentile) resolved only by duration." + "value": "High severity with EPSS 0.55 accepted on duration alone." } ] }, @@ -10974,7 +10974,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, negligible EPSS." } ] }, @@ -11088,7 +11088,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, negligible EPSS." } ] }, @@ -11202,7 +11202,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, negligible EPSS." } ] }, @@ -11316,7 +11316,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, negligible EPSS." } ] }, @@ -11430,7 +11430,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, negligible EPSS." } ] }, @@ -11544,7 +11544,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, negligible EPSS." } ] }, @@ -11658,7 +11658,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, negligible EPSS." } ] }, @@ -11772,7 +11772,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; duration-based acceptance is low-stakes." + "value": "Low severity, negligible EPSS." } ] }, @@ -11882,11 +11882,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "On logback-classic, critical severity resolved solely via absence-of-execution over the observation window." + "value": "Low EPSS (0.08), Shield coverage present, logback-classic instance." } ] }, @@ -11996,11 +11996,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "On logback-classic, high severity resting only on duration reasoning." + "value": "Very low EPSS (0.01), Shield coverage present, logback-classic instance." } ] }, @@ -12114,7 +12114,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "On spring-beans, KEV critical Spring4Shell resolved by duration alone rather than structural non-reachability, despite active library usage." + "value": "KEV-listed Spring4Shell with EPSS 1.0 resolved solely on absence-of-execution for spring-beans, not structural non-reachability." } ] }, @@ -12228,7 +12228,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -12342,7 +12342,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity tomcat-embed-core CVE resolved solely on absence-of-execution grounds." + "value": "Critical severity with EPSS 0.22 accepted on duration alone." } ] }, @@ -12456,7 +12456,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed critical CVE with EPSS near 1.0 resolved only by duration - a high-priority candidate for manual reachability verification given active exploitation in the wild." + "value": "KEV-listed, EPSS 1.0, critical Tomcat partial-PUT RCE resolved solely on absence-of-execution." } ] }, @@ -12566,11 +12566,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim resting solely on elapsed monitoring time." + "value": "Very low EPSS (0.01), Shield coverage present." } ] }, @@ -12684,7 +12684,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, in_triage with no CVE Shield coverage - correctly left open, but a high-priority unresolved item." + "value": "Critical severity, in_triage with no CVE Shield coverage at all, no possible active backstop." } ] }, @@ -12798,7 +12798,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed critical CVE (Ghostcat) with EPSS 0.99 resolved only by duration - warrants manual verification given active exploitation history." + "value": "KEV-listed Ghostcat vulnerability with EPSS 0.99 resolved solely on absence-of-execution." } ] }, @@ -12908,11 +12908,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim resting solely on absence-of-execution." + "value": "Low EPSS (0.04), Shield coverage present." } ] }, @@ -13026,7 +13026,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity CVE with elevated EPSS (98.7th percentile) resolved only by duration." + "value": "Critical severity with EPSS 0.44 accepted on duration alone." } ] }, @@ -13136,11 +13136,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim resting solely on elapsed monitoring time." + "value": "Very low EPSS (0.01), Shield coverage present." } ] }, @@ -13254,7 +13254,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, in_triage with no CVE Shield coverage - open, high-priority item to track." + "value": "Critical severity, in_triage with no CVE Shield coverage at all." } ] }, @@ -13368,7 +13368,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with EPSS near 1.0 resolved solely on absence-of-execution." + "value": "EPSS 1.0, high severity, resolved solely on absence-of-execution." } ] }, @@ -13482,7 +13482,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed high severity CVE with EPSS near 1.0 resolved only by duration - warrants manual verification given confirmed exploitation." + "value": "KEV-listed Tomcat JSP upload RCE with EPSS 1.0 resolved solely on absence-of-execution." } ] }, @@ -13596,7 +13596,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (99.4th percentile) resolved solely by duration." + "value": "High severity with EPSS 0.73 accepted on duration alone." } ] }, @@ -13710,7 +13710,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on elapsed monitoring time." + "value": "High severity with EPSS 0.21 accepted on duration alone." } ] }, @@ -13820,11 +13820,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS (0.11), Shield coverage present." } ] }, @@ -13934,11 +13934,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on absence-of-execution." + "value": "Low EPSS (0.03), Shield coverage present." } ] }, @@ -14052,7 +14052,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (99.2nd percentile) resolved only by duration." + "value": "High severity with EPSS 0.67 accepted on duration alone." } ] }, @@ -14162,11 +14162,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Very low EPSS (0.01), Shield coverage present." } ] }, @@ -14280,7 +14280,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (99.4th percentile) resolved solely by duration." + "value": "High severity with EPSS 0.73 accepted on duration alone." } ] }, @@ -14390,11 +14390,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on elapsed monitoring time." + "value": "Negligible EPSS, Shield coverage present." } ] }, @@ -14504,11 +14504,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "EPSS 0.18, Shield coverage present." } ] }, @@ -14618,11 +14618,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on absence-of-execution." + "value": "Low EPSS (0.05), Shield coverage present." } ] }, @@ -14736,7 +14736,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (99th percentile) resolved only by duration." + "value": "High severity with EPSS 0.57 accepted on duration alone." } ] }, @@ -14846,11 +14846,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS (0.03), Shield coverage present." } ] }, @@ -14960,11 +14960,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on elapsed monitoring time." + "value": "Low EPSS (0.02), Shield coverage present." } ] }, @@ -15074,11 +15074,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS (0.02), Shield coverage present." } ] }, @@ -15188,11 +15188,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on absence-of-execution." + "value": "Low EPSS (0.02), Shield coverage present." } ] }, @@ -15302,11 +15302,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Low EPSS (0.02), Shield coverage present." } ] }, @@ -15420,7 +15420,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (99th percentile) resolved only by duration." + "value": "High severity with EPSS 0.6 accepted on duration alone." } ] }, @@ -15534,7 +15534,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, in_triage with no CVE Shield coverage - open item needing verification, elevated EPSS (97.9th percentile)." + "value": "High severity, elevated EPSS (0.27), in_triage with no CVE Shield coverage at all." } ] }, @@ -15648,7 +15648,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (97.6th percentile) resolved only by duration." + "value": "High severity with EPSS 0.23 accepted on duration alone." } ] }, @@ -15762,7 +15762,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, in_triage with no CVE Shield coverage - open item to track." + "value": "High severity, in_triage with no CVE Shield coverage at all." } ] }, @@ -15876,7 +15876,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed high severity CVE (HTTP/2 Rapid Reset) with EPSS at 100th percentile resolved only by duration - a priority candidate for manual verification." + "value": "KEV-listed HTTP/2 Rapid Reset with EPSS 1.0 resolved solely on absence-of-execution." } ] }, @@ -15990,7 +15990,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (97.3th percentile) resolved solely by duration." + "value": "High severity with EPSS 0.21 accepted on duration alone." } ] }, @@ -16104,7 +16104,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, in_triage with no CVE Shield coverage - open item to track." + "value": "High severity, in_triage with no CVE Shield coverage at all." } ] }, @@ -16214,11 +16214,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on elapsed monitoring time." + "value": "Low EPSS (0.03), Shield coverage present." } ] }, @@ -16328,11 +16328,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Very low EPSS (0.01), Shield coverage present." } ] }, @@ -16442,11 +16442,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on absence-of-execution." + "value": "Low EPSS (0.09), Shield coverage present." } ] }, @@ -16560,7 +16560,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity CVE with elevated EPSS (99th percentile) resolved only by duration." + "value": "High severity with EPSS 0.57 accepted on duration alone." } ] }, @@ -16674,7 +16674,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -16784,11 +16784,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no CVE Shield coverage - correctly left open, worth tracking." + "value": "Medium severity, in_triage with no Shield coverage, but low stakes." } ] }, @@ -16902,7 +16902,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable despite elevated EPSS." + "value": "Medium severity keeps stakes manageable despite EPSS 0.46." } ] }, @@ -17016,7 +17016,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, moderate EPSS." } ] }, @@ -17130,7 +17130,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -17244,7 +17244,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -17358,7 +17358,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, very low EPSS." } ] }, @@ -17472,7 +17472,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -17586,7 +17586,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -17696,11 +17696,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no CVE Shield coverage - open item worth tracking." + "value": "Medium severity, in_triage with no Shield coverage, but low stakes." } ] }, @@ -17810,11 +17810,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no CVE Shield coverage - open item worth tracking." + "value": "Medium severity, in_triage with no Shield coverage, but low stakes." } ] }, @@ -17924,11 +17924,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable despite high EPSS." + "value": "EPSS 0.94 is very high despite medium severity score, worth confirming." } ] }, @@ -18038,11 +18038,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity but in_triage with no CVE Shield coverage - correctly left open rather than closed." + "value": "Low severity, in_triage with no Shield coverage, minimal stakes." } ] }, @@ -18154,7 +18154,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is despite critical severity." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -18266,7 +18266,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -18378,7 +18378,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -18490,7 +18490,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -18602,7 +18602,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is despite critical severity." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -18714,7 +18714,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is despite critical severity." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -18826,7 +18826,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -18938,7 +18938,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -19050,7 +19050,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -19162,7 +19162,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -19274,7 +19274,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -19386,7 +19386,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -19498,7 +19498,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -19608,7 +19608,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -19720,7 +19720,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is despite critical severity." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -19832,7 +19832,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -19944,7 +19944,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -20056,7 +20056,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -20168,7 +20168,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -20278,11 +20278,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity thymeleaf CVE resolved solely on absence-of-execution despite heavy library usage (367 of 549 classes)." + "value": "Negligible EPSS despite critical score, Shield coverage present." } ] }, @@ -20392,11 +20392,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim resting only on elapsed monitoring time." + "value": "Very low EPSS (0.01), Shield coverage present." } ] }, @@ -20506,11 +20506,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity claim resting only on elapsed monitoring time." + "value": "Very low EPSS (0.01), Shield coverage present." } ] }, @@ -20620,11 +20620,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity mysql-connector-java CVE resolved solely by duration." + "value": "Low EPSS, minimal class usage (4 of 347), Shield coverage present." } ] }, @@ -20734,11 +20734,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on absence-of-execution." + "value": "Very low EPSS, Shield coverage present." } ] }, @@ -20852,7 +20852,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -20964,7 +20964,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unknown severity, low EPSS." } ] }, @@ -21076,7 +21076,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is despite high severity." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -21186,11 +21186,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-boot CVE resolved solely on absence-of-execution." + "value": "High severity but very low EPSS (0.01), Shield coverage present." } ] }, @@ -21300,11 +21300,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on elapsed monitoring time." + "value": "Negligible EPSS, Shield coverage present." } ] }, @@ -21414,11 +21414,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Negligible EPSS, Shield coverage present." } ] }, @@ -21532,7 +21532,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -21644,7 +21644,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact regardless of missing Shield coverage." } ] }, @@ -21756,7 +21756,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -21866,11 +21866,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity gson CVE resolved solely by duration despite active library usage." + "value": "Low class usage and moderate EPSS, Shield coverage present." } ] }, @@ -21982,7 +21982,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -22094,7 +22094,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -22206,7 +22206,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -22318,7 +22318,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -22430,7 +22430,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -22542,7 +22542,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -22656,7 +22656,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity xalan CVE with a notably high EPSS (99.6th percentile) resolved solely on duration despite active library usage." + "value": "EPSS 0.81 is very high, only 7 of 1501 classes loaded but claim rests on duration not reachability, worth confirming." } ] }, @@ -22766,11 +22766,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-core CVE resolved solely on absence-of-execution." + "value": "Low EPSS (0.03), Shield coverage present." } ] }, @@ -22880,11 +22880,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on elapsed monitoring time." + "value": "Low EPSS (0.09), Shield coverage present." } ] }, @@ -22994,11 +22994,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Negligible EPSS, Shield coverage present." } ] }, @@ -23108,11 +23108,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting solely on absence-of-execution." + "value": "Low EPSS (0.03), Shield coverage present." } ] }, @@ -23226,7 +23226,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -23340,7 +23340,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable despite elevated EPSS." + "value": "Medium severity keeps stakes manageable despite EPSS 0.35." } ] }, @@ -23454,7 +23454,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -23568,7 +23568,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -23678,11 +23678,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-expression CVE resolved solely on absence-of-execution." + "value": "Negligible EPSS, Shield coverage present." } ] }, @@ -23792,11 +23792,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity claim resting only on elapsed monitoring time." + "value": "Negligible EPSS, Shield coverage present." } ] }, @@ -23906,11 +23906,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, duration-only justification." + "value": "Negligible EPSS, Shield coverage present." } ] }, @@ -24024,7 +24024,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -24138,7 +24138,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -24252,7 +24252,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable despite elevated EPSS." + "value": "Medium severity keeps stakes manageable despite EPSS 0.36." } ] }, @@ -24366,7 +24366,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, negligible EPSS." } ] }, @@ -24480,7 +24480,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -24590,11 +24590,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity spring-boot-autoconfigure CVE resolved solely on absence-of-execution." + "value": "Low EPSS (0.01), Shield coverage present." } ] }, @@ -24708,7 +24708,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, in_triage with no CVE Shield coverage and a very high EPSS (99.7th percentile) - a priority open item to verify." + "value": "High severity, EPSS 0.87, in_triage with no CVE Shield coverage at all, no active backstop possible." } ] }, @@ -24822,7 +24822,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -24932,11 +24932,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity hibernate-core CVE resolved solely by duration despite very heavy library usage (1563 of 3787 classes)." + "value": "Low EPSS (0.03), Shield coverage present." } ] }, @@ -25050,7 +25050,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -25164,7 +25164,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, in_triage with no CVE Shield coverage - open item requiring verification." + "value": "High severity, in_triage with no CVE Shield coverage at all." } ] }, @@ -25274,11 +25274,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity hibernate-validator CVE resolved solely by duration." + "value": "Negligible EPSS, Shield coverage present." } ] }, @@ -25388,11 +25388,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no CVE Shield coverage - open item worth tracking." + "value": "Medium severity, in_triage with no Shield coverage, but low stakes." } ] }, @@ -25502,11 +25502,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no CVE Shield coverage - open item worth tracking." + "value": "Medium severity, in_triage with no Shield coverage, but low stakes." } ] }, @@ -25616,11 +25616,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity guava CVE resolved solely by duration despite active library usage." + "value": "Negligible EPSS, minimal class usage (5 of 1717), Shield coverage present." } ] }, @@ -25730,11 +25730,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no CVE Shield coverage - open item worth tracking." + "value": "Medium severity, in_triage with no Shield coverage, but low stakes." } ] }, @@ -25848,7 +25848,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; duration-based acceptance is low-stakes." + "value": "Low severity, low EPSS." } ] }, @@ -25960,7 +25960,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance despite elevated EPSS." + "value": "Unknown severity, moderate EPSS but low stakes given severity classification." } ] }, @@ -26072,7 +26072,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance despite elevated EPSS." + "value": "Unknown severity, low stakes despite EPSS 0.25." } ] }, @@ -26186,7 +26186,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, moderate EPSS." } ] }, @@ -26300,7 +26300,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -26414,7 +26414,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -26526,7 +26526,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -26638,7 +26638,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -26750,7 +26750,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -26862,7 +26862,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -26974,7 +26974,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -27086,7 +27086,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -27198,7 +27198,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -27310,7 +27310,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim on commons-lang3, safe as-is (same CVE affecting a second library, separately verified as unreachable)." + "value": "code_not_reachable, zero classes loaded, structural fact, commons-lang3 instance." } ] }, @@ -27422,7 +27422,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim on commons-lang3, safe as-is (same CVE affecting a second library, separately verified as unreachable)." + "value": "code_not_reachable, zero classes loaded, structural fact, commons-lang3 instance." } ] }, @@ -27536,7 +27536,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -27650,7 +27650,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -27764,7 +27764,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, low EPSS." } ] }, @@ -27878,7 +27878,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here (spring-context instance)." + "value": "Medium severity, low EPSS, spring-context instance." } ] }, @@ -27992,7 +27992,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity; duration-based acceptance is low-stakes." + "value": "Low severity, negligible EPSS." } ] }, @@ -28104,7 +28104,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -28216,7 +28216,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim; Shield coverage is irrelevant here since the justification is structural, not duration-based." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -28328,7 +28328,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable structural claim, safe as-is." + "value": "code_not_reachable, zero classes loaded, structural fact." } ] }, @@ -28442,7 +28442,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity; duration-based acceptance reasonable here." + "value": "Medium severity, negligible EPSS." } ] }, @@ -28554,7 +28554,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unscored severity; low stakes for duration-based acceptance." + "value": "Unknown severity, low EPSS." } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index 94f2fe2..92dd0c8 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -41,7 +41,8 @@ public class VEXAdvisor { "You're also given whether Assess (the module that produces the runtime evidence every claim rests on) and " + "ADR (the classic HTTP-rule-based RASP module, formerly branded \"Protect\" - distinct from CVE Shield) " + "are enabled per environment for this application, and whether CVE Shield itself has any coverage for " + - "each specific CVE in that environment scope. Weigh all of this directly: a duration-based claim scoped " + + "each specific CVE at all (a per-CVE, product-level fact - not something that varies by environment). " + + "Weigh all of this directly: a duration-based claim scoped " + "to an environment where Assess has no data or is disabled isn't weak evidence, it's NO evidence - flag " + "it regardless of severity. A claim where CVE Shield has no coverage for that CVE at all is weaker still " + "than one where Shield exists and simply hasn't fired - \"we haven't seen it\" means less when nothing " + @@ -356,7 +357,7 @@ private String formatAppForAi(AppEntry entry) { sb.append("CISA Known Exploited Vulnerabilities (KEV) catalog: ").append(s.cisaKev ? "YES" : "no").append("\n"); } if (s.shieldAvailable != null) { - sb.append("CVE Shield available for this CVE in this environment scope: ") + sb.append("CVE Shield has coverage for this CVE at all (org-wide fact): ") .append(s.shieldAvailable ? "YES" : "NO - no virtual patch coverage at all").append("\n"); } sb.append("Claimed state: ").append(s.state).append("\n"); @@ -565,10 +566,11 @@ private String generateReport(List appResults, List entrie sb.append("\n### Legend\n\n"); sb.append("**VEX** - `NA` = not_affected, `IT` = in_triage\n\n"); - sb.append("**Shield** - whether CVE Shield could catch this specific CVE at all in the environment(s) ") - .append("considered: `Yes` (Shield exists there, even if it hasn't fired), `No` (no Shield coverage for ") - .append("this CVE at all - the claim rests entirely on absence-of-execution, with no possible active ") - .append("backstop), `-` (no signal either way).\n\n"); + sb.append("**Shield** - whether CVE Shield has a virtual patch for this specific CVE at all (a per-CVE, ") + .append("product-level fact - coverage existing anywhere means it's available everywhere Shield is ") + .append("enabled): `Yes` (Shield covers it, even if it hasn't fired), `No` (no Shield coverage for this ") + .append("CVE at all - the claim rests entirely on absence-of-execution, with no possible active ") + .append("backstop), `-` (unknown).\n\n"); sb.append("**Rationale** - why the claim was made, with the day count for the three duration-based reasons:\n\n"); sb.append("| Rationale | Meaning |\n|-----------|---------|\n"); sb.append("| `Library Unused` | Library never loaded at runtime (0 classes) - structural, not time-based |\n"); @@ -582,8 +584,8 @@ private String generateReport(List appResults, List entrie .append("evidence every claim in this report rests on; ADR (formerly branded \"Protect\") is the classic ") .append("HTTP-rule-based RASP module. Neither is CVE Shield - CVE Shield is a separate product that defends ") .append("specific CVEs via a microsandbox rather than HTTP rules. Its own coverage is the per-row **Shield** ") - .append("column above, sourced from the real per-app, per-environment NO_SHIELD/NOT_SEEN signal where ") - .append("available.\n"); + .append("column above - a per-CVE, product-level fact (coverage existing anywhere means it's available ") + .append("everywhere Shield is enabled), not an app- or environment-scoped one.\n"); sb.append("\n---\n\n## Application Detail\n\n"); @@ -672,7 +674,7 @@ private String rationaleWord(VexStatement s) { return "CVE Not Used " + s.daysObserved + "d"; } - /** Whether CVE Shield could even catch this CVE in this environment scope - "-" means no signal either way. */ + /** Whether CVE Shield has any coverage for this CVE at all (org-wide fact) - "-" means unknown. */ private String shieldLabel(Boolean shieldAvailable) { if (shieldAvailable == null) return "-"; return shieldAvailable ? "Yes" : "No"; diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java index bc64a47..6f85f8c 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java @@ -64,10 +64,13 @@ * never suppress a vulnerability we can't positively account for. * 4. classes_used > 0, CVE's env status is NOT_SEEN/NO_SHIELD (or missing) in every environment observed: * NO_SHIELD (confirmed by scanning every app in this org) means CVE Shield has no coverage for this CVE - * in that environment at all, as opposed to NOT_SEEN (Shield exists there and just hasn't fired). This - * matters for the state, not just the reporting: elapsed time can never turn "no detector was watching" - * into "nothing happened," so: - * - shieldAvailability() is false (every considered env is NO_SHIELD) -> in_triage, permanently, + * at all, as opposed to NOT_SEEN (Shield exists and just hasn't fired). Coverage is a per-CVE, + * product-level fact, not an app/environment-scoped one - if Shield covers a CVE anywhere, it covers it + * everywhere Shield/ADR is enabled - so this is decided by the org-wide cveShieldExists flag (see + * shieldAvailability()), not by inferring it from per-app NO_SHIELD/NOT_SEEN status. This matters for + * the state, not just the reporting: elapsed time can never turn "no detector was watching" into + * "nothing happened," so: + * - shieldAvailability() is false (no coverage for this CVE, org-wide) -> in_triage, permanently, * regardless of daysObserved - this can never graduate to not_affected on duration alone. * - shieldAvailability() is true/unknown and days observed >= acceptAfterDays -> not_affected (no * justification), detail explains the day count and threshold as an operational risk-acceptance, @@ -81,9 +84,8 @@ * as its own contrast:assessEnabled and contrast:adrEnabled property (per env) so a human (or the VEX * Advisor) can weigh it. ADR (formerly branded "Protect") is the classic HTTP-rule-based RASP module (the * API's `defend` flag) - a separate product from CVE Shield, which defends specific CVEs via a microsandbox. - * Whether CVE Shield could even catch this CVE at all - contrast:shieldAvailable - prefers the per-app, - * per-environment NO_SHIELD/NOT_SEEN signal above (see shieldAvailability()), falling back to the org-wide - * cveShieldExists flag from /cves only when there's no per-app signal either way (e.g. issue == null). + * Whether CVE Shield could even catch this CVE at all - contrast:shieldAvailable - is the org-wide + * cveShieldExists flag from /cves, verbatim (see shieldAvailability()). * * Usage: * java -jar runtime-analyst.jar vex --app "MyApp" @@ -93,13 +95,12 @@ public class VEXGenerator { private static final List PROTECTED_STATUSES = List.of("PROTECTING", "BLOCKED"); - // NO_SHIELD means CVE Shield has no coverage for this CVE in this environment (confirmed by scanning every - // app in this org - it's a real status value, not documented alongside NOT_SEEN/PROTECTING/BLOCKED/etc). - // It still belongs in the duration-based branch below (absence-of-execution is still the applicable - // reasoning), but is tracked separately so the claim can say "there's no Shield to catch this even if it - // did fire" instead of silently reading the same as a live-but-quiet Shield. + // NO_SHIELD is a real per-app-per-environment status value (confirmed by scanning every app in this org - + // not documented alongside NOT_SEEN/PROTECTING/BLOCKED/etc). It belongs in the same duration-based branch + // as NOT_SEEN below (absence-of-execution is still the applicable reasoning for reaching that branch at + // all) - whether Shield actually has coverage for the CVE is a separate question, decided by the org-wide + // cveShieldExists fact instead (see shieldAvailability()), not by this per-app status. private static final List NOT_SEEN_STATUSES = List.of("NOT_SEEN", "NO_SHIELD"); - private static final String NO_SHIELD_STATUS = "NO_SHIELD"; private String baseUrl; // e.g. https://host/api/ns-ui/v1 private String host; // e.g. https://host @@ -721,7 +722,7 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN detail = "CVE Shield is actively mitigating this vulnerability at runtime in " + app.name + " (" + envScopeLabel() + ")."; } else if (issue != null && isNotSeen(issue)) { - boolean shieldAvail = !Boolean.FALSE.equals(shieldAvailability(issue, orgWideShieldExists)); + boolean shieldAvail = !Boolean.FALSE.equals(shieldAvailability(orgWideShieldExists)); detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used) but this CVE's " + "vulnerable code path has not been observed executing in " + app.name + " (" + envScopeLabel() + ") in " + daysObserved + " days of runtime monitoring"; @@ -744,7 +745,7 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN } else if (issue == null) { // Library confirmed used, but no matching per-CVE environment record found at all - // treat the same as "not seen" using the same duration logic, but flag the missing join. - boolean shieldAvail = !Boolean.FALSE.equals(shieldAvailability(null, orgWideShieldExists)); + boolean shieldAvail = !Boolean.FALSE.equals(shieldAvailability(orgWideShieldExists)); detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used); no per-environment " + "CVE Shield/exposure record found for this CVE+version in " + app.name + ". Not observed " + "executing in " + daysObserved + " days of runtime monitoring for this application"; @@ -798,7 +799,7 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN if (vuln.has("cisa") && !vuln.get("cisa").isJsonNull()) { properties.add(property("contrast:cisaKev", String.valueOf(vuln.get("cisa").getAsBoolean()))); } - Boolean shieldAvailable = shieldAvailability(issue, orgWideShieldExists); + Boolean shieldAvailable = shieldAvailability(orgWideShieldExists); if (shieldAvailable != null) { properties.add(property("contrast:shieldAvailable", String.valueOf(shieldAvailable))); } @@ -859,24 +860,16 @@ private boolean isNotSeenOrNull(String status) { } /** - * Whether CVE Shield could have caught this CVE at all in the environment(s) being considered - true if any - * considered status is a real (non-null) signal other than NO_SHIELD (even NOT_SEEN implies Shield was - * watching and just hasn't fired), false if every considered status that has any data is explicitly - * NO_SHIELD, or null (unknown) when there's no per-app signal either way and no org-wide fact to fall - * back on. + * Whether CVE Shield could catch this CVE at all - this is a per-CVE, product-level fact (does Contrast + * ship a virtual patch definition for it), NOT something that varies by app or environment: coverage + * existing anywhere means it's available everywhere Shield/ADR is enabled. So this is just the org-wide + * cveShieldExists flag from /cves, verbatim - no per-app inference. (An earlier version of this method + * tried to infer availability from per-environment NO_SHIELD/NOT_SEEN status instead, which happened to + * agree with the org-wide fact in every case checked so far, but was solving the wrong problem - it can't + * distinguish "no coverage exists" from "this app's agent hasn't received the rule yet," and coverage + * itself simply isn't an app/environment-scoped concept.) */ - private Boolean shieldAvailability(CveIssue issue, Boolean orgWideShieldExists) { - if (issue != null) { - boolean anyRealSignal = false; - boolean anyNoShield = false; - for (String status : statusesToConsider(issue)) { - if (status == null) continue; - if (NO_SHIELD_STATUS.equals(status)) anyNoShield = true; - else anyRealSignal = true; - } - if (anyRealSignal) return true; - if (anyNoShield) return false; - } + private Boolean shieldAvailability(Boolean orgWideShieldExists) { return orgWideShieldExists; } From b5ee8a78b24af0091b3f0ec070aa3806820f06d3 Mon Sep 17 00:00:00 2001 From: Jeff Williams Date: Thu, 3 Sep 2026 00:21:50 -0400 Subject: [PATCH 16/16] VEXGenerator: exclude CVEs with no Shield coverage entirely, don't claim in_triage "In triage" implies evidence is accumulating toward a future resolution. With no CVE Shield coverage, nothing is running that could ever produce one - marking these in_triage forever was still wrong (spotted via CVE-2020-10693/hibernate-validator: IT + Shield=No + "288d" reads as a real CVE dressed up as a pending VEX claim, not what it actually is). Fixed: no-Shield-coverage CVEs now get no VEX statement at all, joining the same "can't positively account for it" bucket as EXPOSED/EXPLOITED (decision rule 3, renumbered). This exactly reverts to the tool's original silent-drop behavior for this one case - but now it's a documented, counted policy decision instead of an accidental status- matching gap: console output reports "Excluded N CVE(s)... no CVE Shield coverage at all" so it isn't silent. Verified against SAML-PetClinic-Demo: 235 statements (was 251 immediately post-bug, 235 pre-bug) - the 16 no-coverage CVEs (including CVE-2020-13935, CVE-2020-10693, CVE-2020-11996) are gone from the VEX, not misrepresented in it. VEXAdvisor: bigger change - made per-statement review flagging fully deterministic instead of an AI judgment call. Every input the AI was asked to weigh (severity, CISA KEV, EPSS, Assess/ADR enablement) was already a plain fact on the VEX; classifying 235 statements over an AI round-trip added ~8 minutes and ~30,000 output tokens per run without adding judgment, and produced a different flagged count from run to run on identical input (21, 61, 125 across this session) - a real liability for a report meant to be relied on. The one AI call per app is now narrative-only (app description/risk level/rationale/ recommendation), given the already-decided flagged list as context instead of all 235 statements individually. Cut a full vex --analyze run on SAML-PetClinic-Demo from ~8 minutes/$0.60+ to under 30 seconds/$0.024, same reproducible flagged count every time. Removed the now-dead "No Shield Coverage Nd" rationale word and its Legend row (unreachable now that VEXGenerator excludes those CVEs outright) and the "statements" array from the AI's output schema. Regenerated samples/sample-vex.json and sample-vex-advisor.md; re-validated against the CycloneDX 1.6 schema. --- README.md | 2 +- samples/sample-vex-advisor.md | 43 +- samples/sample-vex.json | 5150 ++++++----------- .../runtimeanalyst/VEXAdvisor.java | 252 +- .../runtimeanalyst/VEXGenerator.java | 78 +- 5 files changed, 1844 insertions(+), 3681 deletions(-) diff --git a/README.md b/README.md index 22399c7..513f188 100644 --- a/README.md +++ b/README.md @@ -226,7 +226,7 @@ Note: `PROTECTED_AT_RUNTIME` (CVE Shield actively mitigating) is implemented but - **Quantum Advisor** - findings grouped by risk level (CRITICAL/HIGH/MEDIUM/LOW/NOT_QUANTUM_ISSUE), with an "Application Context" section describing each app from its architecture graph data - **AI Advisor** - organized as an inventory of AI-enabled applications (one section per app, not per finding): an AI-generated description of what the app does, then each AI usage instance with model/provider/endpoint and a description of what that specific call is doing, inferred from the key methods around it in the stack trace -- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Flags claims that rest purely on "N days without observed execution" for a CRITICAL/HIGH-severity CVE in a heavily-loaded library as `needs_review`, while treating `code_not_reachable`/`protected_at_runtime` claims as structurally sound regardless of severity. Weighs each CVE's EPSS score/percentile and CISA KEV (Known Exploited Vulnerabilities catalog) status alongside CVSS severity - a duration-only claim on a KEV-listed or high-EPSS CVE is judged more harshly than the same claim on a CVE with no evidence of real-world exploitation. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Shield | Rationale`, e.g. `Yes` / `CVE Not Used 288d` or `No` / `CVE Not Used 288d` - decoded in a legend) instead of a full-sentence rationale repeated per claim. The **Shield** column is `contrast:shieldAvailable` - `No` means the claim rests entirely on absence-of-execution with no possible active backstop, which is materially weaker than the same claim where Shield exists and simply hasn't fired. Rows sort CISA KEV-listed first, then by EPSS, then by CVSS score, so the claims worth a second look surface at the top without needing a separate flag column - there's no distinct action per severity tier (the real options, verify reachability or upgrade, are the same regardless), so the report doesn't pretend otherwise with a column that can't back it up. Each app's section also shows a **Protection Status** line (Assess/ADR enablement per environment, from the VEX's own `components[]` - see above) and feeds all of this to the AI: a duration-based claim in an environment where Assess has no data isn't weak evidence, it's *no* evidence, and a claim where Shield has zero coverage for that CVE is weaker still than one where Shield exists and just hasn't fired. +- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Which claims need review is decided **deterministically**, not by an AI call - CRITICAL/HIGH severity, CISA KEV listing, EPSS ≥ 0.5, or Assess having no runtime data to back the claim are all plain facts already sitting on the VEX, so classifying 235 statements one-by-one over an AI round-trip added minutes of latency and cost without adding judgment, and made the same VEX produce a different flagged count from run to run on identical input (21, 61, 125 in one session) - a real liability for something meant to be relied on. The single AI call per app is used only for the narrative (a 2-3 sentence description, risk level, risk rationale, and recommendation, given the already-decided flagged list) - turning facts into prose, not deciding what the facts are. This cut the advisor's typical run from ~8 minutes and ~30,000 output tokens down to under 30 seconds and ~2,000. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Shield | Rationale`, e.g. `Yes` / `CVE Not Used 288d` or `No` / `CVE Not Used 288d` - decoded in a legend) instead of a full-sentence rationale repeated per claim. The **Shield** column is `contrast:shieldAvailable` - `No` means the claim rests entirely on absence-of-execution with no possible active backstop, which is materially weaker than the same claim where Shield exists and simply hasn't fired (and CVEs with `No` here never actually reach the VEX at all - see the `vex` command's policy above). Rows sort CISA KEV-listed first, then by EPSS, then by CVSS score, so the claims worth a second look surface at the top. Each app's section also shows a **Protection Status** line (Assess/ADR enablement per environment, from the VEX's own `components[]` - see above): a duration-based claim in an environment where Assess has no data isn't weak evidence, it's *no* evidence, and is flagged for review on that basis alone. Both the Quantum and AI Advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component. The VEX Advisor writes `contrast:vexAdvisorAssessment` (`sound`/`needs_review`) and `contrast:vexAdvisorRationale` back onto each vulnerability's `properties[]`. All of this happens automatically as part of every `--analyze` run, no separate step needed. diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md index a73606e..505746a 100644 --- a/samples/sample-vex-advisor.md +++ b/samples/sample-vex-advisor.md @@ -5,7 +5,7 @@ --- -**Report Date:** September 2, 2026 +**Report Date:** September 3, 2026 **Assessment Type:** VEX Claim Soundness Review --- @@ -14,24 +14,24 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated from Contrast Security runtime library-usage and CVE Shield data. It does not re-derive whether a CVE exists - it judges whether each `not_affected`/`in_triage` claim is well-supported enough to rely on as-is, or whether a human should look at it first. -**Coverage:** 1 application(s), 251 VEX statement(s) reviewed. +**Coverage:** 1 application(s), 235 VEX statement(s) reviewed. **Key Findings:** -- **37 of 251 claim(s) flagged for human review** before relying on them. -- **8 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2022-22965, CVE-2018-1273, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. -- **12 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+6 more). +- **125 of 235 claim(s) flagged for human review** before relying on them. +- **7 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2018-1273, CVE-2022-22965, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. +- **11 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+5 more). - Application(s) rated CRITICAL/HIGH risk: SAML-PetClinic-Demo. ### Applications | Application | Risk Level | Statements | |-------------|------------|------------| -| SAML-PetClinic-Demo | HIGH | 251 | +| SAML-PetClinic-Demo | CRITICAL | 235 | | Risk Level | Applications | |------------|--------------| -| HIGH | 1 | +| CRITICAL | 1 | ### Legend @@ -39,7 +39,7 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated **Shield** - whether CVE Shield has a virtual patch for this specific CVE at all (a per-CVE, product-level fact - coverage existing anywhere means it's available everywhere Shield is enabled): `Yes` (Shield covers it, even if it hasn't fired), `No` (no Shield coverage for this CVE at all - the claim rests entirely on absence-of-execution, with no possible active backstop), `-` (unknown). -**Rationale** - why the claim was made, with the day count for the three duration-based reasons: +**Rationale** - why the claim was made, with the day count for the two duration-based reasons: | Rationale | Meaning | |-----------|---------| @@ -47,7 +47,8 @@ This report reviews VEX (Vulnerability Exploitability eXchange) claims generated | `CVE Shielded` | CVE Shield actively mitigating at runtime - an active control, not time-based | | `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold | | `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold - may still graduate to `CVE Not Used` | -| `No Shield Coverage Nd` | in_triage, permanently - CVE Shield has no coverage for this CVE here (Shield column is `No`), so elapsed time is never evidence of anything and this can never graduate, no matter how large Nd gets | + +CVEs with no CVE Shield coverage at all never appear in this table - VEXGenerator excludes them entirely rather than claiming `not_affected` or `in_triage` without a detector ever having watched (see its console output for the excluded count). Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth a second look surface at the top - see the Key Findings above for which specific CVEs those are. @@ -59,15 +60,15 @@ Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, s ### SAML-PetClinic-Demo -**Risk Level:** HIGH +**Risk Level:** CRITICAL **Protection Status:** Assess (runtime evidence): dev=enabled, qa=no data, prod=enabled · ADR (classic RASP, formerly "Protect" - not CVE Shield): dev=disabled, qa=no data, prod=enabled -SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominated by a long tail of jackson-databind and tomcat-embed-core CVEs. The large majority are either structurally sound (code_not_reachable, zero classes loaded) or duration-based claims on low-EPSS CVEs backed by 288 days of Assess data from dev and prod, with Shield coverage and prod ADR as an active backstop. A meaningful subset, however, rests on duration alone for CVEs with very high EPSS or CISA KEV status, including three separate Spring4Shell (CVE-2022-22965) claims, Ghostcat (CVE-2020-1938), the Tomcat JSP-upload RCE (CVE-2017-12617), HTTP/2 Rapid Reset (CVE-2023-44487), and the 2025 Tomcat partial-PUT RCE (CVE-2025-24813). +This VEX set for SAML-PetClinic-Demo covers 235 claims across a stack of badly outdated dependencies (jackson-databind 2.8.8, spring-webmvc/spring-beans/spring-core 4.3.9, tomcat-embed-core 8.5.15, dom4j 1.6.1, hsqldb 2.3.5, thymeleaf 3.0.6, mysql-connector-java 5.1.42, and others). 110 claims look sound, but 125 are flagged, all of them 'not_affected' determinations resting entirely on 288 days of Assess runtime observation with no exploit ever triggering, not on actual remediation. -**Risk Rationale:** Most claims are well-supported, but a cluster of critical/high severity, actively-exploited (KEV or EPSS near 1.0) CVEs on spring-beans, spring-webmvc, spring-data-commons, and tomcat-embed-core are marked not_affected using only absence-of-execution reasoning, not code_not_reachable or protected_at_runtime. Given ADR is disabled in dev, any wrong call on these specific findings has no active backstop in that tier. Several tomcat-embed-core, hibernate-validator, and guava CVEs are also in_triage with zero CVE Shield coverage at all, meaning there is no active mitigation possible if the absence-of-execution assumption is wrong. +**Risk Rationale:** Six of the flagged CVEs are CISA KEV-listed with EPSS at or near 1.0, meaning they're being actively exploited in the wild right now: CVE-2022-22965 (Spring4Shell, on both spring-webmvc and spring-beans), CVE-2018-1273 (spring-data-commons RCE, EPSS 0.97), CVE-2020-1938 (Ghostcat, tomcat-embed-core, EPSS 0.99), CVE-2025-24813 (tomcat-embed-core, EPSS 1.0), CVE-2017-12617 (tomcat-embed-core, EPSS 1.0), and CVE-2023-44487 (HTTP/2 Rapid Reset, EPSS 1.0). Every one of these is marked 'not_affected' purely because Assess never saw the vulnerable code path get hit in 288 days of dev/prod traffic. That's an absence-of-evidence argument on some of the most actively weaponized CVEs in the CVE database, sitting on a jackson-databind version (2.8.8) that alone carries 46 flagged critical/high deserialization CVEs. ADR, the runtime protection module that would actually block exploitation attempts, is disabled in dev and has no data in qa, so these versions have never been stress-tested against real attack traffic in any lower environment. Only prod runs both Assess and ADR, and even there the VEX claims are based on non-observation, not on ADR having intercepted and blocked an attempt. -**Recommendation:** Have a human re-verify reachability (not just runtime absence) for the KEV-listed and EPSS-near-1.0 claims before trusting them, especially the three CVE-2022-22965 (Spring4Shell) instances, CVE-2020-1938 (Ghostcat), CVE-2017-12617, CVE-2023-44487, CVE-2025-24813, and CVE-2018-1273. Also prioritize the tomcat-embed-core, hibernate-validator, and guava CVEs currently in_triage with no CVE Shield coverage, since those have no possible active backstop today. +**Recommendation:** Before trusting this VEX as-is, get a human to look at the six CISA KEV / high-EPSS claims first: CVE-2022-22965 (Spring4Shell) on spring-webmvc and spring-beans, CVE-2018-1273 on spring-data-commons, CVE-2020-1938 (Ghostcat) and CVE-2025-24813 and CVE-2017-12617 on tomcat-embed-core, and CVE-2023-44487 (Rapid Reset). These need either confirmed compensating controls (WAF rules, ADR blocking rules actively enabled and tested against these specific CVEs) or an actual upgrade plan, not a 'we never saw it happen' justification. Given the age and scale of the outdated dependency set (jackson-databind, spring 4.3.9, tomcat 8.5.15 are all years past end-of-life), treat this whole app as a strong upgrade candidate rather than relying on runtime silence as proof of safety, and confirm ADR is actually enabled and exercised against known KEV payloads in a lower environment before leaning on these VEX claims for a production risk decision. | CVE | Library | Score | VEX | Shield | Rationale | |-----|---------|-------|-----|--------|-----------| @@ -82,7 +83,6 @@ SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominat | CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Yes | Library Unused | | CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | Yes | CVE Not Used 288d | | CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | Yes | CVE Not Used 288d | -| CVE-2020-13935 | tomcat-embed-websocket@8.5.15 | 7.5 | IT | No | No Shield Coverage 288d | | CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | @@ -101,7 +101,6 @@ SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominat | CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Yes | Library Unused | -| CVE-2020-11996 | tomcat-embed-core@8.5.15 | 7.5 | IT | No | No Shield Coverage 288d | | CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | Yes | CVE Not Used 288d | | CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | Yes | CVE Not Used 288d | @@ -151,7 +150,6 @@ SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominat | CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | | CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Yes | Library Unused | -| CVE-2020-1935 | tomcat-embed-core@8.5.15 | 4.8 | IT | No | No Shield Coverage 288d | | CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | @@ -172,8 +170,6 @@ SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominat | CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Yes | Library Unused | | CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Yes | Library Unused | -| CVE-2023-41080 | tomcat-embed-core@8.5.15 | 6.1 | IT | No | No Shield Coverage 288d | -| CVE-2023-45648 | tomcat-embed-core@8.5.15 | 5.3 | IT | No | No Shield Coverage 288d | | CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | | CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | @@ -191,7 +187,6 @@ SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominat | CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Yes | Library Unused | -| CVE-2018-10237 | guava@19.0 | 5.9 | IT | No | No Shield Coverage 288d | | CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Yes | Library Unused | | CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | Yes | CVE Not Used 288d | | CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Yes | Library Unused | @@ -222,7 +217,6 @@ SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominat | CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | | CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | -| CVE-2026-41293 | tomcat-embed-core@8.5.15 | 9.8 | IT | No | No Shield Coverage 288d | | CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | @@ -237,7 +231,6 @@ SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominat | CVE-2020-15250 | junit@4.12 | 5.5 | NA | Yes | Library Unused | | CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Yes | CVE Not Used 288d | -| CVE-2020-10693 | hibernate-validator@5.3.5.Final | 5.3 | IT | No | No Shield Coverage 288d | | CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Yes | Library Unused | | CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Yes | Library Unused | | CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | @@ -252,12 +245,9 @@ SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominat | CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | Yes | CVE Not Used 288d | | CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | -| CVE-2026-24880 | tomcat-embed-core@8.5.15 | 7.5 | IT | No | No Shield Coverage 288d | | CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Yes | Library Unused | | CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Yes | Library Unused | | CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | -| CVE-2026-42498 | tomcat-embed-core@8.5.15 | 7.3 | IT | No | No Shield Coverage 288d | -| CVE-2025-35036 | hibernate-validator@5.3.5.Final | 7.3 | IT | No | No Shield Coverage 288d | | CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | | CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | | CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | @@ -283,7 +273,6 @@ SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominat | CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Yes | Library Unused | | CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | Yes | CVE Not Used 288d | | CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | Yes | CVE Not Used 288d | -| CVE-2025-66614 | tomcat-embed-core@8.5.15 | 9.1 | IT | No | No Shield Coverage 288d | | CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Yes | CVE Not Used 288d | | CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Yes | Library Unused | | CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | @@ -301,19 +290,15 @@ SAML-PetClinic-Demo carries roughly 250 VEX claims across ~35 libraries, dominat | CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | | CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | | CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | -| CVE-2023-1932 | hibernate-validator@5.3.5.Final | 6.1 | IT | No | No Shield Coverage 288d | | CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | | CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Yes | Library Unused | -| CVE-2026-54515 | jackson-databind@2.8.8 | 5.3 | IT | No | No Shield Coverage 288d | -| CVE-2026-54514 | jackson-databind@2.8.8 | 5.3 | IT | No | No Shield Coverage 288d | | CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | | CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | Yes | CVE Not Used 288d | -| CVE-2026-43514 | tomcat-embed-core@8.5.15 | 3.7 | IT | No | No Shield Coverage 288d | | CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | Yes | CVE Not Used 288d | | CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | Yes | CVE Not Used 288d | | CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | diff --git a/samples/sample-vex.json b/samples/sample-vex.json index bf25a0c..32e44b5 100644 --- a/samples/sample-vex.json +++ b/samples/sample-vex.json @@ -3,7 +3,7 @@ "specVersion": "1.6", "version": 1, "metadata": { - "timestamp": "2026-09-03T03:38:50Z", + "timestamp": "2026-09-03T04:21:00Z", "component": { "type": "application", "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", @@ -176,11 +176,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.1), Shield coverage exists, 288 days well past threshold." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -290,11 +290,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.06), Shield coverage backstop present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -408,7 +408,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with elevated EPSS (0.5) accepted on duration alone, worth a second look." + "value": "Flagged: CRITICAL severity, EPSS 0.5 - duration-based claim, not a structural guarantee." } ] }, @@ -522,7 +522,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with EPSS 0.27 relying solely on absence-of-execution." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -632,11 +632,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -746,11 +746,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.09), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -860,11 +860,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.13), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -974,11 +974,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.08), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -1088,11 +1088,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.1), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -1202,11 +1202,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.18, moderate, Shield backstop present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -1316,11 +1316,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.11), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -1430,11 +1430,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.18, Shield backstop present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -1544,11 +1544,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.06), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -1658,11 +1658,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.06), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -1772,11 +1772,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.11), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -1886,11 +1886,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -2000,11 +2000,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.11), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -2114,11 +2114,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.11), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -2228,11 +2228,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -2346,7 +2346,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with notably high EPSS (0.38) resolved on duration alone." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -2460,7 +2460,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, EPSS 0.2, worth confirming before relying on absence-of-execution." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -2570,11 +2570,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -2684,11 +2684,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.08), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -2798,11 +2798,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.08), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -2912,11 +2912,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.08), high severity but Shield backstop present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -3026,11 +3026,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.13), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -3140,11 +3140,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.09), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -3254,11 +3254,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.08), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -3368,11 +3368,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.1), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -3482,11 +3482,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -3596,11 +3596,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -3710,11 +3710,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -3824,11 +3824,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -3942,7 +3942,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.21 resolved purely on duration." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -4052,11 +4052,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.03), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -4166,11 +4166,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -4280,11 +4280,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.11), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -4394,11 +4394,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -4508,11 +4508,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -4622,11 +4622,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -4736,11 +4736,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.07), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -4850,11 +4850,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.07), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -4964,11 +4964,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.09), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -5078,11 +5078,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.07), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -5192,11 +5192,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.03), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -5306,11 +5306,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.03), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -5420,11 +5420,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.18, under review threshold, Shield backstop present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -5534,11 +5534,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.09), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -5648,11 +5648,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -5762,11 +5762,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.11), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -5876,11 +5876,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.07), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -5994,7 +5994,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.22 accepted on duration alone." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -6108,7 +6108,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, lower stakes even with EPSS 0.45." + "value": "sound" } ] }, @@ -6222,48 +6222,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS (0.11)." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-54515-bf88c7b27e95cbadce4e7c316a56c3efffda8026", - "id": "CVE-2026-54515", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-26119-3e752dae0006ad516bf6f4138316db7b262912d0", + "id": "CVE-2023-26119", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26119" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26119" }, - "score": 5.3, - "severity": "medium", + "score": 9.8, + "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.", - "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2026-54515. Latest available release is 2.22.1.", + "description": "Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.", + "recommendation": "Upgrade htmlunit from 2.21 to 2.70.0 to remediate CVE-2023-26119.", "analysis": { - "state": "in_triage", - "response": [ - "update" - ], - "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 1295 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "ref": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21", "versions": [ { - "version": "2.8.8", + "version": "2.21", "status": "affected" }, { - "version": "2.21.5", + "version": "2.70.0", "status": "unaffected" } ] @@ -6280,11 +6278,11 @@ }, { "name": "contrast:classesUsed", - "value": "263" + "value": "0" }, { "name": "contrast:classCount", - "value": "582" + "value": "1295" }, { "name": "contrast:daysObserved", @@ -6300,11 +6298,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "27.36" + "value": "83.68" }, { "name": "contrast:cisaKev", @@ -6312,15 +6310,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", - "value": "2.22.1" + "value": "2.70.0" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -6328,7 +6326,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -6336,48 +6334,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Correctly in_triage given no Shield coverage, but medium severity and negligible EPSS keep stakes low." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-54514-bf88c7b27e95cbadce4e7c316a56c3efffda8026", - "id": "CVE-2026-54514", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-5529-3e752dae0006ad516bf6f4138316db7b262912d0", + "id": "CVE-2020-5529", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5529" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5529" }, - "score": 5.3, - "severity": "medium", + "score": 8.1, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", - "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2026-54514. Latest available release is 2.22.1.", + "description": "HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.", + "recommendation": "Upgrade htmlunit from 2.21 to 2.70.0 to remediate CVE-2020-5529.", "analysis": { - "state": "in_triage", - "response": [ - "update" - ], - "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 1295 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "ref": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21", "versions": [ { - "version": "2.8.8", + "version": "2.21", "status": "affected" }, { - "version": "2.21.5", + "version": "2.70.0", "status": "unaffected" } ] @@ -6394,11 +6390,11 @@ }, { "name": "contrast:classesUsed", - "value": "263" + "value": "0" }, { "name": "contrast:classCount", - "value": "582" + "value": "1295" }, { "name": "contrast:daysObserved", @@ -6414,11 +6410,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.05" }, { "name": "contrast:epssPercentile", - "value": "29.75" + "value": "91.2" }, { "name": "contrast:cisaKev", @@ -6426,15 +6422,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", - "value": "2.22.1" + "value": "2.70.0" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -6442,7 +6438,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -6450,22 +6446,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Correctly in_triage given no Shield coverage, but medium severity and negligible EPSS keep stakes low." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-26119-3e752dae0006ad516bf6f4138316db7b262912d0", - "id": "CVE-2023-26119", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-10683-5d3ccc056b6f056dbf0dddfdf43894b9065a8f94", + "id": "CVE-2020-10683", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26119" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10683" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26119" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10683" }, "score": 9.8, "severity": "critical", @@ -6473,23 +6469,25 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.", - "recommendation": "Upgrade htmlunit from 2.21 to 2.70.0 to remediate CVE-2023-26119.", + "description": "dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.", + "recommendation": "Upgrade dom4j from 1.6.1 to 20040902.021138 to remediate CVE-2020-10683.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 1295 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (1 of 190 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21", + "ref": "pkg:maven/dom4j/dom4j@1.6.1", "versions": [ { - "version": "2.21", + "version": "1.6.1", "status": "affected" }, { - "version": "2.70.0", + "version": "20040902.021138", "status": "unaffected" } ] @@ -6506,11 +6504,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "1" }, { "name": "contrast:classCount", - "value": "1295" + "value": "190" }, { "name": "contrast:daysObserved", @@ -6526,11 +6524,11 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.07" }, { "name": "contrast:epssPercentile", - "value": "83.68" + "value": "93.91" }, { "name": "contrast:cisaKev", @@ -6542,7 +6540,7 @@ }, { "name": "contrast:latestVersion", - "value": "2.70.0" + "value": "20040902.021138" }, { "name": "contrast:devStatus", @@ -6558,50 +6556,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-5529-3e752dae0006ad516bf6f4138316db7b262912d0", - "id": "CVE-2020-5529", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1000632-5d3ccc056b6f056dbf0dddfdf43894b9065a8f94", + "id": "CVE-2018-1000632", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5529" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000632" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5529" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000632" }, - "score": 8.1, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.", - "recommendation": "Upgrade htmlunit from 2.21 to 2.70.0 to remediate CVE-2020-5529.", + "description": "dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.", + "recommendation": "Upgrade dom4j from 1.6.1 to 20040902.021138 to remediate CVE-2018-1000632.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 1295 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (1 of 190 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21", + "ref": "pkg:maven/dom4j/dom4j@1.6.1", "versions": [ { - "version": "2.21", + "version": "1.6.1", "status": "affected" }, { - "version": "2.70.0", + "version": "20040902.021138", "status": "unaffected" } ] @@ -6618,11 +6618,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "1" }, { "name": "contrast:classCount", - "value": "1295" + "value": "190" }, { "name": "contrast:daysObserved", @@ -6638,11 +6638,11 @@ }, { "name": "contrast:epssScore", - "value": "0.05" + "value": "0.07" }, { "name": "contrast:epssPercentile", - "value": "91.2" + "value": "93.35" }, { "name": "contrast:cisaKev", @@ -6654,7 +6654,7 @@ }, { "name": "contrast:latestVersion", - "value": "2.70.0" + "value": "20040902.021138" }, { "name": "contrast:devStatus", @@ -6670,248 +6670,20 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-10683-5d3ccc056b6f056dbf0dddfdf43894b9065a8f94", - "id": "CVE-2020-10683", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-1471-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-1471", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10683" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10683" - }, - "score": 9.8, - "severity": "critical", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "description": "dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.", - "recommendation": "Upgrade dom4j from 1.6.1 to 20040902.021138 to remediate CVE-2020-10683.", - "analysis": { - "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (1 of 190 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." - }, - "affects": [ - { - "ref": "pkg:maven/dom4j/dom4j@1.6.1", - "versions": [ - { - "version": "1.6.1", - "status": "affected" - }, - { - "version": "20040902.021138", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "1" - }, - { - "name": "contrast:classCount", - "value": "190" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.07" - }, - { - "name": "contrast:epssPercentile", - "value": "93.91" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "20040902.021138" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "Minimal class usage (1 of 190) and low EPSS, Shield backstop present." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1000632-5d3ccc056b6f056dbf0dddfdf43894b9065a8f94", - "id": "CVE-2018-1000632", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000632" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000632" - }, - "score": 7.5, - "severity": "high", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" - } - ], - "description": "dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.", - "recommendation": "Upgrade dom4j from 1.6.1 to 20040902.021138 to remediate CVE-2018-1000632.", - "analysis": { - "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (1 of 190 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." - }, - "affects": [ - { - "ref": "pkg:maven/dom4j/dom4j@1.6.1", - "versions": [ - { - "version": "1.6.1", - "status": "affected" - }, - { - "version": "20040902.021138", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "1" - }, - { - "name": "contrast:classCount", - "value": "190" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.07" - }, - { - "name": "contrast:epssPercentile", - "value": "93.35" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "20040902.021138" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "Minimal class usage and low EPSS, Shield backstop present." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-1471-7a27ea250c5130b2922b86dea63cbb1cc10a660c", - "id": "CVE-2022-1471", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, "ratings": [ { @@ -7014,7 +6786,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact despite EPSS 1.0." + "value": "sound" } ] }, @@ -7126,7 +6898,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -7238,7 +7010,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -7350,7 +7122,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -7462,7 +7234,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -7574,7 +7346,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -7686,7 +7458,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -7798,7 +7570,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -7906,11 +7678,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed Spring4Shell with EPSS 1.0 resolved solely on absence-of-execution for spring-beans, not structural non-reachability." + "value": "sound" } ] }, @@ -8024,7 +7796,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed critical vulnerability with EPSS 0.97 resolved solely on absence-of-execution, not structural non-reachability." + "value": "Flagged: CRITICAL severity, CISA KEV-listed, EPSS 0.97 - duration-based claim, not a structural guarantee." } ] }, @@ -8134,11 +7906,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.02), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -8248,11 +8020,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -8366,7 +8138,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "sound" } ] }, @@ -8480,7 +8252,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "sound" } ] }, @@ -8592,7 +8364,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low EPSS, Shield backstop present." + "value": "sound" } ] }, @@ -8702,11 +8474,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.04), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -8816,11 +8588,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.08), Shield coverage present, logback-classic instance." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -8930,11 +8702,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.01), Shield coverage present, logback-classic instance." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -9048,7 +8820,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, @@ -9160,7 +8932,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS." + "value": "sound" } ] }, @@ -9272,7 +9044,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS." + "value": "sound" } ] }, @@ -9384,7 +9156,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS." + "value": "sound" } ] }, @@ -9496,7 +9268,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS." + "value": "sound" } ] }, @@ -9608,7 +9380,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS." + "value": "sound" } ] }, @@ -9720,7 +9492,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, negligible EPSS." + "value": "sound" } ] }, @@ -9834,7 +9606,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with EPSS 0.32 accepted on duration alone." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -9944,11 +9716,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.04), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -10058,11 +9830,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.01), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -10172,11 +9944,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.03), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -10290,7 +10062,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, @@ -10404,7 +10176,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, spring-context instance." + "value": "sound" } ] }, @@ -10518,7 +10290,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, @@ -10628,11 +10400,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed Spring4Shell with EPSS 1.0 resolved solely on absence-of-execution for spring-beans, not structural non-reachability." + "value": "sound" } ] }, @@ -10742,11 +10514,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -10860,7 +10632,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.55 accepted on duration alone." + "value": "Flagged: HIGH severity, EPSS 0.55 - duration-based claim, not a structural guarantee." } ] }, @@ -10974,7 +10746,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "sound" } ] }, @@ -11088,7 +10860,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "sound" } ] }, @@ -11202,7 +10974,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "sound" } ] }, @@ -11316,7 +11088,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "sound" } ] }, @@ -11430,7 +11202,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "sound" } ] }, @@ -11544,7 +11316,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "sound" } ] }, @@ -11658,7 +11430,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "sound" } ] }, @@ -11772,7 +11544,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, negligible EPSS." + "value": "sound" } ] }, @@ -11882,11 +11654,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.08), Shield coverage present, logback-classic instance." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -11996,11 +11768,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.01), Shield coverage present, logback-classic instance." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -12110,11 +11882,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed Spring4Shell with EPSS 1.0 resolved solely on absence-of-execution for spring-beans, not structural non-reachability." + "value": "sound" } ] }, @@ -12228,7 +12000,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, @@ -12342,7 +12114,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with EPSS 0.22 accepted on duration alone." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -12456,7 +12228,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed, EPSS 1.0, critical Tomcat partial-PUT RCE resolved solely on absence-of-execution." + "value": "Flagged: CRITICAL severity, CISA KEV-listed, EPSS 1.0 - duration-based claim, not a structural guarantee." } ] }, @@ -12564,127 +12336,13 @@ "name": "contrast:prodStatus", "value": "NOT_SEEN" }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.01), Shield coverage present." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41293-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2026-41293", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293" - }, - "score": 9.8, - "severity": "critical", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "description": "Improper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-41293. Latest available release is 10.1.57.", - "analysis": { - "state": "in_triage", - "response": [ - "update" - ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." - }, - "affects": [ - { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", - "versions": [ - { - "version": "8.5.15", - "status": "affected" - }, - { - "version": "9.0.118", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "387" - }, - { - "name": "contrast:classCount", - "value": "1481" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.02" - }, - { - "name": "contrast:epssPercentile", - "value": "73.56" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "false" - }, - { - "name": "contrast:latestVersion", - "value": "11.0.24" - }, - { - "name": "contrast:devStatus", - "value": "NO_SHIELD" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NO_SHIELD" - }, { "name": "contrast:vexAdvisorAssessment", "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, in_triage with no CVE Shield coverage at all, no possible active backstop." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -12798,7 +12456,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed Ghostcat vulnerability with EPSS 0.99 resolved solely on absence-of-execution." + "value": "Flagged: CRITICAL severity, CISA KEV-listed, EPSS 0.99 - duration-based claim, not a structural guarantee." } ] }, @@ -12908,11 +12566,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.04), Shield coverage present." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -13026,7 +12684,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity with EPSS 0.44 accepted on duration alone." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -13134,127 +12792,13 @@ "name": "contrast:prodStatus", "value": "NOT_SEEN" }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.01), Shield coverage present." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-66614-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-66614", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614" - }, - "score": 9.1, - "severity": "critical", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" - } - ], - "description": "Improper Input Validation vulnerability.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.\nTomcat did not validate that the host name provided via the SNI \nextension was the same as the host name provided in the HTTP host header \nfield. If Tomcat was configured with more than one virtual host and the \nTLS configuration for one of those hosts did not require client \ncertificate authentication but another one did, it was possible for a \nclient to bypass the client certificate authentication by sending \ndifferent host names in the SNI extension and the HTTP host header field.\n\n\n\nThe vulnerability only applies if client certificate authentication is \nonly enforced at the Connector. It does not apply if client certificate \nauthentication is enforced at the web application.\n\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-66614. Latest available release is 10.1.57.", - "analysis": { - "state": "in_triage", - "response": [ - "update" - ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." - }, - "affects": [ - { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", - "versions": [ - { - "version": "8.5.15", - "status": "affected" - }, - { - "version": "9.0.118", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "387" - }, - { - "name": "contrast:classCount", - "value": "1481" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.0" - }, - { - "name": "contrast:epssPercentile", - "value": "14.35" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "false" - }, - { - "name": "contrast:latestVersion", - "value": "11.0.24" - }, - { - "name": "contrast:devStatus", - "value": "NO_SHIELD" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NO_SHIELD" - }, { "name": "contrast:vexAdvisorAssessment", "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Critical severity, in_triage with no CVE Shield coverage at all." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, @@ -13368,7 +12912,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 1.0, high severity, resolved solely on absence-of-execution." + "value": "Flagged: HIGH severity, EPSS 1.0 - duration-based claim, not a structural guarantee." } ] }, @@ -13482,7 +13026,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed Tomcat JSP upload RCE with EPSS 1.0 resolved solely on absence-of-execution." + "value": "Flagged: HIGH severity, CISA KEV-listed, EPSS 1.0 - duration-based claim, not a structural guarantee." } ] }, @@ -13596,7 +13140,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.73 accepted on duration alone." + "value": "Flagged: HIGH severity, EPSS 0.73 - duration-based claim, not a structural guarantee." } ] }, @@ -13710,7 +13254,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.21 accepted on duration alone." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -13820,11 +13364,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.11), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -13934,11 +13478,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.03), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -14052,7 +13596,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.67 accepted on duration alone." + "value": "Flagged: HIGH severity, EPSS 0.67 - duration-based claim, not a structural guarantee." } ] }, @@ -14162,11 +13706,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.01), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -14280,7 +13824,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.73 accepted on duration alone." + "value": "Flagged: HIGH severity, EPSS 0.73 - duration-based claim, not a structural guarantee." } ] }, @@ -14390,11 +13934,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -14504,11 +14048,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.18, Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -14618,11 +14162,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.05), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -14736,7 +14280,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.57 accepted on duration alone." + "value": "Flagged: HIGH severity, EPSS 0.57 - duration-based claim, not a structural guarantee." } ] }, @@ -14846,11 +14390,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.03), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -14960,11 +14504,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.02), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -15074,11 +14618,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.02), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -15188,11 +14732,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.02), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -15302,11 +14846,11 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.02), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -15420,22 +14964,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.6 accepted on duration alone." + "value": "Flagged: HIGH severity, EPSS 0.6 - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-11996-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2020-11996", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-24549-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-24549", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11996" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11996" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" }, "score": 7.5, "severity": "high", @@ -15443,14 +14987,14 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-11996. Latest available release is 10.1.57.", + "description": "Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-24549. Latest available release is 10.1.57.", "analysis": { - "state": "in_triage", + "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { @@ -15498,11 +15042,11 @@ }, { "name": "contrast:epssScore", - "value": "0.27" + "value": "0.23" }, { "name": "contrast:epssPercentile", - "value": "97.88" + "value": "97.6" }, { "name": "contrast:cisaKev", @@ -15510,7 +15054,7 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", @@ -15518,7 +15062,7 @@ }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -15526,7 +15070,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -15534,22 +15078,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, elevated EPSS (0.27), in_triage with no CVE Shield coverage at all." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-24549-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2024-24549", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-44487-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-44487", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" }, "score": 7.5, "severity": "high", @@ -15557,8 +15101,8 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-24549. Latest available release is 10.1.57.", + "description": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-44487. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -15612,15 +15156,15 @@ }, { "name": "contrast:epssScore", - "value": "0.23" + "value": "1.0" }, { "name": "contrast:epssPercentile", - "value": "97.6" + "value": "100.0" }, { "name": "contrast:cisaKev", - "value": "false" + "value": "true" }, { "name": "contrast:shieldAvailable", @@ -15648,37 +15192,37 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.23 accepted on duration alone." + "value": "Flagged: HIGH severity, CISA KEV-listed, EPSS 1.0 - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-24880-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2026-24880", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1336-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1336", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24880" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24880" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-24880. Latest available release is 10.1.57.", + "description": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1336. Latest available release is 10.1.57.", "analysis": { - "state": "in_triage", + "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { @@ -15726,11 +15270,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.21" }, { "name": "contrast:epssPercentile", - "value": "42.18" + "value": "97.34" }, { "name": "contrast:cisaKev", @@ -15738,7 +15282,7 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", @@ -15746,7 +15290,7 @@ }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -15754,7 +15298,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -15762,31 +15306,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, in_triage with no CVE Shield coverage at all." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-44487-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2023-44487", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-46701-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-46701", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" }, - "score": 7.5, + "score": 7.3, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], - "description": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-44487. Latest available release is 10.1.57.", + "description": "Improper Handling of Case Sensitivity vulnerability in Apache Tomcat\u0027s GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-46701. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -15840,15 +15384,15 @@ }, { "name": "contrast:epssScore", - "value": "1.0" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "100.0" + "value": "86.11" }, { "name": "contrast:cisaKev", - "value": "true" + "value": "false" }, { "name": "contrast:shieldAvailable", @@ -15876,31 +15420,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "KEV-listed HTTP/2 Rapid Reset with EPSS 1.0 resolved solely on absence-of-execution." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1336-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-1336", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12418-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-12418", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" }, - "score": 7.5, + "score": 7.0, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1336. Latest available release is 10.1.57.", + "description": "When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-12418. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -15954,11 +15498,11 @@ }, { "name": "contrast:epssScore", - "value": "0.21" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "97.34" + "value": "66.64" }, { "name": "contrast:cisaKev", @@ -15990,37 +15534,37 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.21 accepted on duration alone." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-42498-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2026-42498", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-25329-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-25329", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42498" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42498" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" }, - "score": 7.3, + "score": 7.0, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-42498. Latest available release is 10.1.57.", + "description": "The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-25329. Latest available release is 10.1.57.", "analysis": { - "state": "in_triage", + "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { @@ -16068,11 +15612,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.09" }, { "name": "contrast:epssPercentile", - "value": "46.41" + "value": "95.09" }, { "name": "contrast:cisaKev", @@ -16080,7 +15624,7 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", @@ -16088,7 +15632,7 @@ }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -16096,7 +15640,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -16104,31 +15648,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, in_triage with no CVE Shield coverage at all." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-46701-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-46701", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-9484-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2020-9484", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" }, - "score": 7.3, + "score": 7.0, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Improper Handling of Case Sensitivity vulnerability in Apache Tomcat\u0027s GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-46701. Latest available release is 10.1.57.", + "description": "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter\u003d\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-9484. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -16182,11 +15726,11 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.57" }, { "name": "contrast:epssPercentile", - "value": "86.11" + "value": "98.99" }, { "name": "contrast:cisaKev", @@ -16214,35 +15758,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.03), Shield coverage present." + "value": "Flagged: HIGH severity, EPSS 0.57 - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12418-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2019-12418", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1305-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1305", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" }, - "score": 7.0, - "severity": "high", + "score": 6.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-12418. Latest available release is 10.1.57.", + "description": "Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1305. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -16296,11 +15840,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.14" }, { "name": "contrast:epssPercentile", - "value": "66.64" + "value": "96.38" }, { "name": "contrast:cisaKev", @@ -16332,31 +15876,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.01), Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-25329-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2021-25329", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0221-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-0221", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" }, - "score": 7.0, - "severity": "high", + "score": 6.1, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "description": "The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-25329. Latest available release is 10.1.57.", + "description": "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0221. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -16410,11 +15954,11 @@ }, { "name": "contrast:epssScore", - "value": "0.09" + "value": "0.46" }, { "name": "contrast:epssPercentile", - "value": "95.09" + "value": "98.71" }, { "name": "contrast:cisaKev", @@ -16446,31 +15990,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.09), Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-9484-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2020-9484", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-24122-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-24122", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" }, - "score": 7.0, - "severity": "high", + "score": 5.9, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter\u003d\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-9484. Latest available release is 10.1.57.", + "description": "When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-24122. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -16524,11 +16068,11 @@ }, { "name": "contrast:epssScore", - "value": "0.57" + "value": "0.23" }, { "name": "contrast:epssPercentile", - "value": "98.99" + "value": "97.58" }, { "name": "contrast:cisaKev", @@ -16556,35 +16100,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity with EPSS 0.57 accepted on duration alone." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1305-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-1305", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8037-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-8037", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" }, - "score": 6.5, + "score": 5.9, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1305. Latest available release is 10.1.57.", + "description": "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8037. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -16638,11 +16182,11 @@ }, { "name": "contrast:epssScore", - "value": "0.14" + "value": "0.11" }, { "name": "contrast:epssPercentile", - "value": "96.38" + "value": "95.67" }, { "name": "contrast:cisaKev", @@ -16674,37 +16218,37 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-41080-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2023-41080", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1304-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1304", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41080" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41080" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" }, - "score": 6.1, + "score": 5.9, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.\n\nThe vulnerability is limited to the ROOT (default) web application.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-41080. Latest available release is 10.1.57.", + "description": "The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1304. Latest available release is 10.1.57.", "analysis": { - "state": "in_triage", + "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { @@ -16752,11 +16296,11 @@ }, { "name": "contrast:epssScore", - "value": "0.06" + "value": "0.17" }, { "name": "contrast:epssPercentile", - "value": "92.87" + "value": "96.86" }, { "name": "contrast:cisaKev", @@ -16764,7 +16308,7 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", @@ -16772,7 +16316,7 @@ }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -16780,7 +16324,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -16788,31 +16332,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no Shield coverage, but low stakes." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0221-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2019-0221", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-61795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-61795", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" }, - "score": 6.1, + "score": 5.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0221. Latest available release is 10.1.57.", + "description": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-61795. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -16866,11 +16410,11 @@ }, { "name": "contrast:epssScore", - "value": "0.46" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "98.71" + "value": "65.15" }, { "name": "contrast:cisaKev", @@ -16902,31 +16446,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity keeps stakes manageable despite EPSS 0.46." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-24122-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2021-24122", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-21733-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-21733", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" }, - "score": 5.9, + "score": 5.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], - "description": "When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-24122. Latest available release is 10.1.57.", + "description": "Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-21733. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -16980,11 +16524,11 @@ }, { "name": "contrast:epssScore", - "value": "0.23" + "value": "0.14" }, { "name": "contrast:epssPercentile", - "value": "97.58" + "value": "96.34" }, { "name": "contrast:cisaKev", @@ -17016,31 +16560,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, moderate EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8037-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-8037", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-42795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-42795", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" }, - "score": 5.9, + "score": 5.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], - "description": "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8037. Latest available release is 10.1.57.", + "description": "Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could \ncause Tomcat to skip some parts of the recycling process leading to \ninformation leaking from the current request/response to the next.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-42795. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -17094,11 +16638,11 @@ }, { "name": "contrast:epssScore", - "value": "0.11" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "95.67" + "value": "80.95" }, { "name": "contrast:cisaKev", @@ -17130,31 +16674,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1304-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-1304", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11784-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-11784", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" }, - "score": 5.9, + "score": 4.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], - "description": "The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1304. Latest available release is 10.1.57.", + "description": "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to \u0027/foo/\u0027 when the user requested \u0027/foo\u0027) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-11784. Latest available release is 10.1.57.", "analysis": { "state": "not_affected", "response": [ @@ -17208,11 +16752,11 @@ }, { "name": "contrast:epssScore", - "value": "0.17" + "value": "0.94" }, { "name": "contrast:epssPercentile", - "value": "96.86" + "value": "99.85" }, { "name": "contrast:cisaKev", @@ -17240,52 +16784,50 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "Flagged: EPSS 0.94 - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-61795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2025-61795", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-1000487-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2017-1000487", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" }, - "score": 5.3, - "severity": "medium", + "score": 9.8, + "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-61795. Latest available release is 10.1.57.", + "description": "Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2017-1000487. Latest available release is 3.6.1.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", "versions": [ { - "version": "8.5.15", + "version": "3.0.8", "status": "affected" }, { - "version": "9.0.118", + "version": "4.0.3", "status": "unaffected" } ] @@ -17302,11 +16844,11 @@ }, { "name": "contrast:classesUsed", - "value": "387" + "value": "0" }, { "name": "contrast:classCount", - "value": "1481" + "value": "102" }, { "name": "contrast:daysObserved", @@ -17322,11 +16864,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.06" }, { "name": "contrast:epssPercentile", - "value": "65.15" + "value": "93.28" }, { "name": "contrast:cisaKev", @@ -17338,7 +16880,7 @@ }, { "name": "contrast:latestVersion", - "value": "11.0.24" + "value": "4.0.3" }, { "name": "contrast:devStatus", @@ -17358,48 +16900,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, very low EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-21733-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2024-21733", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-67030-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2025-67030", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" }, - "score": 5.3, - "severity": "medium", + "score": 8.8, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "description": "Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-21733. Latest available release is 10.1.57.", + "description": "Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2025-67030. Latest available release is 3.6.1.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", "versions": [ { - "version": "8.5.15", + "version": "3.0.8", "status": "affected" }, { - "version": "9.0.118", + "version": "4.0.3", "status": "unaffected" } ] @@ -17416,11 +16956,11 @@ }, { "name": "contrast:classesUsed", - "value": "387" + "value": "0" }, { "name": "contrast:classCount", - "value": "1481" + "value": "102" }, { "name": "contrast:daysObserved", @@ -17436,11 +16976,11 @@ }, { "name": "contrast:epssScore", - "value": "0.14" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "96.34" + "value": "49.29" }, { "name": "contrast:cisaKev", @@ -17452,7 +16992,7 @@ }, { "name": "contrast:latestVersion", - "value": "11.0.24" + "value": "4.0.3" }, { "name": "contrast:devStatus", @@ -17472,48 +17012,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-42795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2023-42795", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4244-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2022-4244", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" }, - "score": 5.3, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could \ncause Tomcat to skip some parts of the recycling process leading to \ninformation leaking from the current request/response to the next.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-42795. Latest available release is 10.1.57.", + "description": "A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4244. Latest available release is 3.6.1.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", "versions": [ { - "version": "8.5.15", + "version": "3.0.8", "status": "affected" }, { - "version": "9.0.118", + "version": "4.0.3", "status": "unaffected" } ] @@ -17530,11 +17068,11 @@ }, { "name": "contrast:classesUsed", - "value": "387" + "value": "0" }, { "name": "contrast:classCount", - "value": "1481" + "value": "102" }, { "name": "contrast:daysObserved", @@ -17550,11 +17088,11 @@ }, { "name": "contrast:epssScore", - "value": "0.02" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "80.95" + "value": "69.52" }, { "name": "contrast:cisaKev", @@ -17566,7 +17104,7 @@ }, { "name": "contrast:latestVersion", - "value": "11.0.24" + "value": "4.0.3" }, { "name": "contrast:devStatus", @@ -17586,48 +17124,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-45648-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2023-45648", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4245-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2022-4245", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45648" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45648" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" }, - "score": 5.3, + "score": 4.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], - "description": "Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially \ncrafted, invalid trailer header could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-45648. Latest available release is 10.1.57.", + "description": "A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --\u003e sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4245. Latest available release is 3.6.1.", "analysis": { - "state": "in_triage", - "response": [ - "update" - ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", "versions": [ { - "version": "8.5.15", + "version": "3.0.8", "status": "affected" }, { - "version": "9.0.118", + "version": "4.0.3", "status": "unaffected" } ] @@ -17644,11 +17180,11 @@ }, { "name": "contrast:classesUsed", - "value": "387" + "value": "0" }, { "name": "contrast:classCount", - "value": "1481" + "value": "102" }, { "name": "contrast:daysObserved", @@ -17664,11 +17200,11 @@ }, { "name": "contrast:epssScore", - "value": "0.06" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "92.66" + "value": "50.52" }, { "name": "contrast:cisaKev", @@ -17676,15 +17212,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", - "value": "11.0.24" + "value": "4.0.3" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -17692,7 +17228,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -17700,48 +17236,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no Shield coverage, but low stakes." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-1935-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2020-1935", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20445-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-20445", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1935" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1935" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" }, - "score": 4.8, - "severity": "medium", + "score": 9.1, + "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-1935. Latest available release is 10.1.57.", + "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20445.", "analysis": { - "state": "in_triage", - "response": [ - "update" - ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "8.5.15", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "9.0.118", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -17758,11 +17292,11 @@ }, { "name": "contrast:classesUsed", - "value": "387" + "value": "0" }, { "name": "contrast:classCount", - "value": "1481" + "value": "727" }, { "name": "contrast:daysObserved", @@ -17778,11 +17312,11 @@ }, { "name": "contrast:epssScore", - "value": "0.09" + "value": "0.13" }, { "name": "contrast:epssPercentile", - "value": "95.05" + "value": "96.17" }, { "name": "contrast:cisaKev", @@ -17790,15 +17324,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", - "value": "11.0.24" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -17806,7 +17340,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -17814,48 +17348,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no Shield coverage, but low stakes." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11784-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2018-11784", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20444-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-20444", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" }, - "score": 4.3, - "severity": "medium", + "score": 9.1, + "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to \u0027/foo/\u0027 when the user requested \u0027/foo\u0027) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-11784. Latest available release is 10.1.57.", + "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\"", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20444.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "8.5.15", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "9.0.118", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -17872,11 +17404,11 @@ }, { "name": "contrast:classesUsed", - "value": "387" + "value": "0" }, { "name": "contrast:classCount", - "value": "1481" + "value": "727" }, { "name": "contrast:daysObserved", @@ -17892,11 +17424,11 @@ }, { "name": "contrast:epssScore", - "value": "0.94" + "value": "0.09" }, { "name": "contrast:epssPercentile", - "value": "99.85" + "value": "94.87" }, { "name": "contrast:cisaKev", @@ -17908,7 +17440,7 @@ }, { "name": "contrast:latestVersion", - "value": "11.0.24" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", @@ -17924,52 +17456,50 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.94 is very high despite medium severity score, worth confirming." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43514-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", - "id": "CVE-2026-43514", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37136-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-37136", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43514" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43514" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" }, - "score": 3.7, - "severity": "low", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", - "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43514. Latest available release is 10.1.57.", + "description": "The Bzip2 decompression decoder function doesn\u0027t allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37136.", "analysis": { - "state": "in_triage", - "response": [ - "update" - ], - "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "8.5.15", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "9.0.118", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -17986,11 +17516,11 @@ }, { "name": "contrast:classesUsed", - "value": "387" + "value": "0" }, { "name": "contrast:classCount", - "value": "1481" + "value": "727" }, { "name": "contrast:daysObserved", @@ -18006,11 +17536,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.06" }, { "name": "contrast:epssPercentile", - "value": "28.04" + "value": "92.72" }, { "name": "contrast:cisaKev", @@ -18018,15 +17548,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", - "value": "11.0.24" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -18034,7 +17564,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -18042,46 +17572,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, in_triage with no Shield coverage, minimal stakes." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-1000487-faba5d28a07fcde50c8c26d3f002774acf11843e", - "id": "CVE-2017-1000487", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37137-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-37137", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" }, - "score": 9.8, - "severity": "critical", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.", - "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2017-1000487. Latest available release is 3.6.1.", + "description": "The Snappy frame decoder function doesn\u0027t restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37137.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "3.0.8", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "4.0.3", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -18102,7 +17632,7 @@ }, { "name": "contrast:classCount", - "value": "102" + "value": "727" }, { "name": "contrast:daysObserved", @@ -18118,11 +17648,11 @@ }, { "name": "contrast:epssScore", - "value": "0.06" + "value": "0.07" }, { "name": "contrast:epssPercentile", - "value": "93.28" + "value": "93.5" }, { "name": "contrast:cisaKev", @@ -18134,7 +17664,7 @@ }, { "name": "contrast:latestVersion", - "value": "4.0.3" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", @@ -18154,46 +17684,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-67030-faba5d28a07fcde50c8c26d3f002774acf11843e", - "id": "CVE-2025-67030", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16869-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-16869", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" }, - "score": 8.8, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code", - "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2025-67030. Latest available release is 3.6.1.", + "description": "Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-16869.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "3.0.8", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "4.0.3", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -18214,7 +17744,7 @@ }, { "name": "contrast:classCount", - "value": "102" + "value": "727" }, { "name": "contrast:daysObserved", @@ -18230,11 +17760,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.08" }, { "name": "contrast:epssPercentile", - "value": "49.29" + "value": "94.6" }, { "name": "contrast:cisaKev", @@ -18246,7 +17776,7 @@ }, { "name": "contrast:latestVersion", - "value": "4.0.3" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", @@ -18266,46 +17796,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4244-faba5d28a07fcde50c8c26d3f002774acf11843e", - "id": "CVE-2022-4244", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-43797-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-43797", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" }, - "score": 7.5, - "severity": "high", + "score": 6.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], - "description": "A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.", - "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4244. Latest available release is 3.6.1.", + "description": "Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. Netty prior to version 4.1.7.1.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to \"sanitize\" header names before it forward these to another remote system when used as proxy. This remote system can\u0027t see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.7.1.Final to receive a patch.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-43797.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "3.0.8", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "4.0.3", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -18326,7 +17856,7 @@ }, { "name": "contrast:classCount", - "value": "102" + "value": "727" }, { "name": "contrast:daysObserved", @@ -18342,11 +17872,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "69.52" + "value": "84.8" }, { "name": "contrast:cisaKev", @@ -18358,7 +17888,7 @@ }, { "name": "contrast:latestVersion", - "value": "4.0.3" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", @@ -18378,46 +17908,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4245-faba5d28a07fcde50c8c26d3f002774acf11843e", - "id": "CVE-2022-4245", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21409-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21409", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" }, - "score": 4.3, + "score": 5.9, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --\u003e sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.", - "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4245. Latest available release is 3.6.1.", + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21409.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", "versions": [ { - "version": "3.0.8", + "version": "3.5.7.Final", "status": "affected" }, { - "version": "4.0.3", + "version": "3.10.6.Final", "status": "unaffected" } ] @@ -18438,7 +17968,7 @@ }, { "name": "contrast:classCount", - "value": "102" + "value": "727" }, { "name": "contrast:daysObserved", @@ -18454,11 +17984,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.05" }, { "name": "contrast:epssPercentile", - "value": "50.52" + "value": "91.54" }, { "name": "contrast:cisaKev", @@ -18470,7 +18000,7 @@ }, { "name": "contrast:latestVersion", - "value": "4.0.3" + "value": "3.10.6.Final" }, { "name": "contrast:devStatus", @@ -18490,31 +18020,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20445-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2019-20445", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21295-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21295", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" }, - "score": 9.1, - "severity": "critical", + "score": 5.9, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20445.", + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel\u0027s pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21295.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", @@ -18566,11 +18096,11 @@ }, { "name": "contrast:epssScore", - "value": "0.13" + "value": "0.19" }, { "name": "contrast:epssPercentile", - "value": "96.17" + "value": "97.09" }, { "name": "contrast:cisaKev", @@ -18602,31 +18132,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20444-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2019-20444", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21290-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21290", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" }, - "score": 9.1, - "severity": "critical", + "score": 5.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\"", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20444.", + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty\u0027s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method \"File.createTempFile\" on unix-like systems creates a random file, but, by default will create this file with the permissions \"-rw-r--r--\". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty\u0027s \"AbstractDiskHttpData\" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own \"java.io.tmpdir\" when you start the JVM or use \"DefaultHttpDataFactory.setBaseDir(...)\" to set the directory to something that is only readable by the current user.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21290.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", @@ -18678,11 +18208,11 @@ }, { "name": "contrast:epssScore", - "value": "0.09" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "94.87" + "value": "76.68" }, { "name": "contrast:cisaKev", @@ -18714,31 +18244,29 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37136-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-37136", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2015-2156-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2015-2156", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" }, - "score": 7.5, - "severity": "high", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "score": 0.0, + "method": "CVSSv31" } ], - "description": "The Bzip2 decompression decoder function doesn\u0027t allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37136.", + "description": "Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2015-2156.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", @@ -18790,11 +18318,11 @@ }, { "name": "contrast:epssScore", - "value": "0.06" + "value": "0.05" }, { "name": "contrast:epssPercentile", - "value": "92.72" + "value": "91.94" }, { "name": "contrast:cisaKev", @@ -18826,46 +18354,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37137-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-37137", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-2332-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2026-2332", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" }, - "score": 7.5, - "severity": "high", + "score": 9.1, + "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "The Snappy frame decoder function doesn\u0027t restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37137.", + "description": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n * https://w4ke.info/2025/06/18/funky-chunks.html\n\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext\u003d\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2026-2332. Latest available release is 12.0.34.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", "versions": [ { - "version": "3.5.7.Final", + "version": "9.4.5.v20170502", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "12.1.7", "status": "unaffected" } ] @@ -18886,7 +18414,7 @@ }, { "name": "contrast:classCount", - "value": "727" + "value": "81" }, { "name": "contrast:daysObserved", @@ -18902,11 +18430,11 @@ }, { "name": "contrast:epssScore", - "value": "0.07" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "93.5" + "value": "68.57" }, { "name": "contrast:cisaKev", @@ -18918,7 +18446,7 @@ }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "12.1.11" }, { "name": "contrast:devStatus", @@ -18938,46 +18466,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16869-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2019-16869", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-11143-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2025-11143", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" }, - "score": 7.5, - "severity": "high", + "score": 6.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], - "description": "Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-16869.", + "description": "The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2025-11143. Latest available release is 12.0.34.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", "versions": [ { - "version": "3.5.7.Final", + "version": "9.4.5.v20170502", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "12.1.7", "status": "unaffected" } ] @@ -18998,7 +18526,7 @@ }, { "name": "contrast:classCount", - "value": "727" + "value": "81" }, { "name": "contrast:daysObserved", @@ -19014,11 +18542,11 @@ }, { "name": "contrast:epssScore", - "value": "0.08" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "94.6" + "value": "5.32" }, { "name": "contrast:cisaKev", @@ -19030,11 +18558,11 @@ }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "12.1.11" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "" }, { "name": "contrast:qaStatus", @@ -19042,7 +18570,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "" }, { "name": "contrast:vexAdvisorAssessment", @@ -19050,46 +18578,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-43797-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-43797", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-6763-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2024-6763", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" }, - "score": 6.5, + "score": 5.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], - "description": "Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. Netty prior to version 4.1.7.1.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to \"sanitize\" header names before it forward these to another remote system when used as proxy. This remote system can\u0027t see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.7.1.Final to receive a patch.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-43797.", + "description": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC. Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2024-6763. Latest available release is 12.0.34.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", "versions": [ { - "version": "3.5.7.Final", + "version": "9.4.5.v20170502", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "12.1.7", "status": "unaffected" } ] @@ -19110,7 +18638,7 @@ }, { "name": "contrast:classCount", - "value": "727" + "value": "81" }, { "name": "contrast:daysObserved", @@ -19126,11 +18654,11 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "84.8" + "value": "59.31" }, { "name": "contrast:cisaKev", @@ -19142,7 +18670,7 @@ }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "12.1.11" }, { "name": "contrast:devStatus", @@ -19162,46 +18690,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21409-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-21409", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-40167-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2023-40167", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" }, - "score": 5.9, + "score": 5.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], - "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21409.", + "description": "Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2023-40167. Latest available release is 12.0.34.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", "versions": [ { - "version": "3.5.7.Final", + "version": "9.4.5.v20170502", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "12.1.7", "status": "unaffected" } ] @@ -19222,7 +18750,7 @@ }, { "name": "contrast:classCount", - "value": "727" + "value": "81" }, { "name": "contrast:daysObserved", @@ -19238,11 +18766,11 @@ }, { "name": "contrast:epssScore", - "value": "0.05" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "91.54" + "value": "62.52" }, { "name": "contrast:cisaKev", @@ -19254,7 +18782,7 @@ }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "12.1.11" }, { "name": "contrast:devStatus", @@ -19274,46 +18802,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21295-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-21295", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-2047-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2022-2047", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" }, - "score": 5.9, - "severity": "medium", + "score": 2.7, + "severity": "low", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" } ], - "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel\u0027s pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21295.", + "description": "In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2022-2047. Latest available release is 12.0.34.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", "versions": [ { - "version": "3.5.7.Final", + "version": "9.4.5.v20170502", "status": "affected" }, { - "version": "3.10.6.Final", + "version": "12.1.7", "status": "unaffected" } ] @@ -19334,7 +18862,7 @@ }, { "name": "contrast:classCount", - "value": "727" + "value": "81" }, { "name": "contrast:daysObserved", @@ -19350,11 +18878,11 @@ }, { "name": "contrast:epssScore", - "value": "0.19" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "97.09" + "value": "67.39" }, { "name": "contrast:cisaKev", @@ -19366,7 +18894,7 @@ }, { "name": "contrast:latestVersion", - "value": "3.10.6.Final" + "value": "12.1.11" }, { "name": "contrast:devStatus", @@ -19386,1400 +18914,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21290-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2021-21290", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41901-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-41901", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" }, - "score": 5.5, - "severity": "medium", + "score": 9.0, + "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], - "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty\u0027s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method \"File.createTempFile\" on unix-like systems creates a random file, but, by default will create this file with the permissions \"-rw-r--r--\". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty\u0027s \"AbstractDiskHttpData\" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own \"java.io.tmpdir\" when you start the JVM or use \"DefaultHttpDataFactory.setBaseDir(...)\" to set the directory to something that is only readable by the current user.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21290.", - "analysis": { - "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." - }, - "affects": [ - { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", - "versions": [ - { - "version": "3.5.7.Final", - "status": "affected" - }, - { - "version": "3.10.6.Final", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "0" - }, - { - "name": "contrast:classCount", - "value": "727" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.02" - }, - { - "name": "contrast:epssPercentile", - "value": "76.68" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "3.10.6.Final" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2015-2156-811465e6dfc89d7c78d21de6a9747b6046cb5403", - "id": "CVE-2015-2156", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" - }, - "score": 0.0, - "method": "CVSSv31" - } - ], - "description": "Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.", - "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2015-2156.", - "analysis": { - "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." - }, - "affects": [ - { - "ref": "pkg:maven/io.netty/netty@3.5.7.Final", - "versions": [ - { - "version": "3.5.7.Final", - "status": "affected" - }, - { - "version": "3.10.6.Final", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "0" - }, - { - "name": "contrast:classCount", - "value": "727" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.05" - }, - { - "name": "contrast:epssPercentile", - "value": "91.94" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "3.10.6.Final" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-2332-c51b8a6a67d64672889249dd958edd77bff8fc0c", - "id": "CVE-2026-2332", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" - }, - "score": 9.1, - "severity": "critical", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" - } - ], - "description": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n * https://w4ke.info/2025/06/18/funky-chunks.html\n\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext\u003d\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.", - "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2026-2332. Latest available release is 12.0.34.", - "analysis": { - "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." - }, - "affects": [ - { - "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", - "versions": [ - { - "version": "9.4.5.v20170502", - "status": "affected" - }, - { - "version": "12.1.7", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "0" - }, - { - "name": "contrast:classCount", - "value": "81" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.01" - }, - { - "name": "contrast:epssPercentile", - "value": "68.57" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "12.1.11" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-11143-c51b8a6a67d64672889249dd958edd77bff8fc0c", - "id": "CVE-2025-11143", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" - }, - "score": 6.5, - "severity": "medium", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" - } - ], - "description": "The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.", - "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2025-11143. Latest available release is 12.0.34.", - "analysis": { - "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." - }, - "affects": [ - { - "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", - "versions": [ - { - "version": "9.4.5.v20170502", - "status": "affected" - }, - { - "version": "12.1.7", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "0" - }, - { - "name": "contrast:classCount", - "value": "81" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.0" - }, - { - "name": "contrast:epssPercentile", - "value": "5.32" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "12.1.11" - }, - { - "name": "contrast:devStatus", - "value": "" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-6763-c51b8a6a67d64672889249dd958edd77bff8fc0c", - "id": "CVE-2024-6763", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" - }, - "score": 5.3, - "severity": "medium", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" - } - ], - "description": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC. Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.", - "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2024-6763. Latest available release is 12.0.34.", - "analysis": { - "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." - }, - "affects": [ - { - "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", - "versions": [ - { - "version": "9.4.5.v20170502", - "status": "affected" - }, - { - "version": "12.1.7", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "0" - }, - { - "name": "contrast:classCount", - "value": "81" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.01" - }, - { - "name": "contrast:epssPercentile", - "value": "59.31" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "12.1.11" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-40167-c51b8a6a67d64672889249dd958edd77bff8fc0c", - "id": "CVE-2023-40167", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" - }, - "score": 5.3, - "severity": "medium", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" - } - ], - "description": "Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.", - "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2023-40167. Latest available release is 12.0.34.", - "analysis": { - "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." - }, - "affects": [ - { - "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", - "versions": [ - { - "version": "9.4.5.v20170502", - "status": "affected" - }, - { - "version": "12.1.7", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "0" - }, - { - "name": "contrast:classCount", - "value": "81" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.01" - }, - { - "name": "contrast:epssPercentile", - "value": "62.52" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "12.1.11" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-2047-c51b8a6a67d64672889249dd958edd77bff8fc0c", - "id": "CVE-2022-2047", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" - }, - "score": 2.7, - "severity": "low", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" - } - ], - "description": "In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.", - "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2022-2047. Latest available release is 12.0.34.", - "analysis": { - "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." - }, - "affects": [ - { - "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", - "versions": [ - { - "version": "9.4.5.v20170502", - "status": "affected" - }, - { - "version": "12.1.7", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "0" - }, - { - "name": "contrast:classCount", - "value": "81" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.01" - }, - { - "name": "contrast:epssPercentile", - "value": "67.39" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "12.1.11" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41901-5101df9798ac08865717dd0bf6860504cd3bd758", - "id": "CVE-2026-41901", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" - }, - "score": 9.0, - "severity": "critical", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" - } - ], - "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.", - "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-41901.", - "analysis": { - "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." - }, - "affects": [ - { - "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", - "versions": [ - { - "version": "3.0.6.RELEASE", - "status": "affected" - }, - { - "version": "3.1.3.RELEASE", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "367" - }, - { - "name": "contrast:classCount", - "value": "549" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.0" - }, - { - "name": "contrast:epssPercentile", - "value": "35.65" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "3.1.3.RELEASE" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS despite critical score, Shield coverage present." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40477-5101df9798ac08865717dd0bf6860504cd3bd758", - "id": "CVE-2026-40477", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" - }, - "score": 9.0, - "severity": "critical", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" - } - ], - "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", - "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40477.", - "analysis": { - "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." - }, - "affects": [ - { - "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", - "versions": [ - { - "version": "3.0.6.RELEASE", - "status": "affected" - }, - { - "version": "3.1.3.RELEASE", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "367" - }, - { - "name": "contrast:classCount", - "value": "549" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.01" - }, - { - "name": "contrast:epssPercentile", - "value": "55.73" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "3.1.3.RELEASE" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.01), Shield coverage present." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40478-5101df9798ac08865717dd0bf6860504cd3bd758", - "id": "CVE-2026-40478", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" - }, - "score": 9.0, - "severity": "critical", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" - } - ], - "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", - "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40478.", - "analysis": { - "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." - }, - "affects": [ - { - "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", - "versions": [ - { - "version": "3.0.6.RELEASE", - "status": "affected" - }, - { - "version": "3.1.3.RELEASE", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "367" - }, - { - "name": "contrast:classCount", - "value": "549" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.01" - }, - { - "name": "contrast:epssPercentile", - "value": "56.16" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "3.1.3.RELEASE" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS (0.01), Shield coverage present." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-3258-80a448a3ec2178b649bb2e3cb3610fab06e11669", - "id": "CVE-2018-3258", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" - }, - "score": 8.8, - "severity": "high", - "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", - "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2018-3258.", - "analysis": { - "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." - }, - "affects": [ - { - "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", - "versions": [ - { - "version": "5.1.42", - "status": "affected" - }, - { - "version": "8.0.33", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "4" - }, - { - "name": "contrast:classCount", - "value": "347" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.04" - }, - { - "name": "contrast:epssPercentile", - "value": "89.09" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "8.0.33" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS, minimal class usage (4 of 347), Shield coverage present." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-22102-80a448a3ec2178b649bb2e3cb3610fab06e11669", - "id": "CVE-2023-22102", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" - }, - "score": 8.3, - "severity": "high", - "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" - } - ], - "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", - "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2023-22102.", - "analysis": { - "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." - }, - "affects": [ - { - "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", - "versions": [ - { - "version": "5.1.42", - "status": "affected" - }, - { - "version": "8.0.33", - "status": "unaffected" - } - ] - } - ], - "properties": [ - { - "name": "contrast:appId", - "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" - }, - { - "name": "contrast:appName", - "value": "SAML-PetClinic-Demo" - }, - { - "name": "contrast:classesUsed", - "value": "4" - }, - { - "name": "contrast:classCount", - "value": "347" - }, - { - "name": "contrast:daysObserved", - "value": "288" - }, - { - "name": "contrast:acceptAfterDays", - "value": "30" - }, - { - "name": "contrast:envFilter", - "value": "ALL" - }, - { - "name": "contrast:epssScore", - "value": "0.01" - }, - { - "name": "contrast:epssPercentile", - "value": "56.43" - }, - { - "name": "contrast:cisaKev", - "value": "false" - }, - { - "name": "contrast:shieldAvailable", - "value": "true" - }, - { - "name": "contrast:latestVersion", - "value": "8.0.33" - }, - { - "name": "contrast:devStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:qaStatus", - "value": "" - }, - { - "name": "contrast:prodStatus", - "value": "NOT_SEEN" - }, - { - "name": "contrast:vexAdvisorAssessment", - "value": "sound" - }, - { - "name": "contrast:vexAdvisorRationale", - "value": "Very low EPSS, Shield coverage present." - } - ] - }, - { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-2692-80a448a3ec2178b649bb2e3cb3610fab06e11669", - "id": "CVE-2019-2692", - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" - }, - "ratings": [ - { - "source": { - "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" - }, - "score": 6.3, - "severity": "medium", - "method": "CVSSv31", - "vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" - } - ], - "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).", - "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2019-2692.", + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-41901.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", "versions": [ { - "version": "5.1.42", + "version": "3.0.6.RELEASE", "status": "affected" }, { - "version": "8.0.33", + "version": "3.1.3.RELEASE", "status": "unaffected" } ] @@ -20796,11 +18972,11 @@ }, { "name": "contrast:classesUsed", - "value": "4" + "value": "367" }, { "name": "contrast:classCount", - "value": "347" + "value": "549" }, { "name": "contrast:daysObserved", @@ -20816,11 +18992,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "40.94" + "value": "35.65" }, { "name": "contrast:cisaKev", @@ -20832,7 +19008,7 @@ }, { "name": "contrast:latestVersion", - "value": "8.0.33" + "value": "3.1.3.RELEASE" }, { "name": "contrast:devStatus", @@ -20848,50 +19024,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-21363-80a448a3ec2178b649bb2e3cb3610fab06e11669", - "id": "CVE-2022-21363", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40477-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-40477", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" }, - "score": 0.0, - "method": "CVSSv31" + "score": 9.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], - "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).", - "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2022-21363.", + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40477.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", "versions": [ { - "version": "5.1.42", + "version": "3.0.6.RELEASE", "status": "affected" }, { - "version": "8.0.33", + "version": "3.1.3.RELEASE", "status": "unaffected" } ] @@ -20908,11 +19086,11 @@ }, { "name": "contrast:classesUsed", - "value": "4" + "value": "367" }, { "name": "contrast:classCount", - "value": "347" + "value": "549" }, { "name": "contrast:daysObserved", @@ -20932,7 +19110,7 @@ }, { "name": "contrast:epssPercentile", - "value": "68.89" + "value": "55.73" }, { "name": "contrast:cisaKev", @@ -20944,7 +19122,7 @@ }, { "name": "contrast:latestVersion", - "value": "8.0.33" + "value": "3.1.3.RELEASE" }, { "name": "contrast:devStatus", @@ -20960,50 +19138,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low EPSS." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-22733-10f526d22f58a32a8c3af26ccb0a6f16f4649935", - "id": "CVE-2026-22733", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40478-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-40478", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" }, - "score": 8.1, - "severity": "high", + "score": 9.0, + "severity": "critical", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], - "description": "Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.", - "recommendation": "Upgrade spring-boot-starter-actuator from 1.5.4.RELEASE to 3.5.12 to remediate CVE-2026-22733. Latest available release is 4.1.0.", + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40478.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@1.5.4.RELEASE", + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "3.0.6.RELEASE", "status": "affected" }, { - "version": "3.5.12", + "version": "3.1.3.RELEASE", "status": "unaffected" } ] @@ -21020,11 +19200,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "367" }, { "name": "contrast:classCount", - "value": "0" + "value": "549" }, { "name": "contrast:daysObserved", @@ -21040,11 +19220,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "28.97" + "value": "56.16" }, { "name": "contrast:cisaKev", @@ -21056,7 +19236,7 @@ }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "3.1.3.RELEASE" }, { "name": "contrast:devStatus", @@ -21072,52 +19252,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-27772-0cf51bb0751c1362a417eb59824d27d2907780d2", - "id": "CVE-2022-27772", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-3258-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2018-3258", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" }, - "score": 7.8, + "score": 8.8, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "** UNSUPPORTED WHEN ASSIGNED ** spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer.", - "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2022-27772. Latest available release is 4.1.0.", + "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2018-3258.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "5.1.42", "status": "affected" }, { - "version": "3.0.0", + "version": "8.0.33", "status": "unaffected" } ] @@ -21134,11 +19314,11 @@ }, { "name": "contrast:classesUsed", - "value": "183" + "value": "4" }, { "name": "contrast:classCount", - "value": "458" + "value": "347" }, { "name": "contrast:daysObserved", @@ -21154,11 +19334,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.04" }, { "name": "contrast:epssPercentile", - "value": "46.27" + "value": "89.09" }, { "name": "contrast:cisaKev", @@ -21170,7 +19350,7 @@ }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "8.0.33" }, { "name": "contrast:devStatus", @@ -21186,52 +19366,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity but very low EPSS (0.01), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-22235-0cf51bb0751c1362a417eb59824d27d2907780d2", - "id": "CVE-2025-22235", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-22102-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2023-22102", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" }, - "score": 7.3, + "score": 8.3, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" } ], - "description": "EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.\n\nYour application may be affected by this if all the following conditions are met:\n\n * You use Spring Security\n * EndpointRequest.to() has been used in a Spring Security chain configuration\n * The endpoint which EndpointRequest references is disabled or not exposed via web\n * Your application handles requests to /null and this path needs protection\n\n\nYou are not affected if any of the following is true:\n\n * You don\u0027t use Spring Security\n * You don\u0027t use EndpointRequest.to()\n * The endpoint which EndpointRequest.to() refers to is enabled and is exposed\n * Your application does not handle requests to /null or this path does not need protection", - "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2025-22235. Latest available release is 4.1.0.", + "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2023-22102.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "5.1.42", "status": "affected" }, { - "version": "3.0.0", + "version": "8.0.33", "status": "unaffected" } ] @@ -21248,11 +19428,11 @@ }, { "name": "contrast:classesUsed", - "value": "183" + "value": "4" }, { "name": "contrast:classCount", - "value": "458" + "value": "347" }, { "name": "contrast:daysObserved", @@ -21268,11 +19448,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "34.63" + "value": "56.43" }, { "name": "contrast:cisaKev", @@ -21284,7 +19464,7 @@ }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "8.0.33" }, { "name": "contrast:devStatus", @@ -21300,52 +19480,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40973-0cf51bb0751c1362a417eb59824d27d2907780d2", - "id": "CVE-2026-40973", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-2692-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2019-2692", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" }, - "score": 7.0, - "severity": "high", + "score": 6.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" } ], - "description": "A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.", - "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2026-40973. Latest available release is 4.1.0.", + "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2019-2692.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "5.1.42", "status": "affected" }, { - "version": "3.0.0", + "version": "8.0.33", "status": "unaffected" } ] @@ -21362,11 +19542,11 @@ }, { "name": "contrast:classesUsed", - "value": "183" + "value": "4" }, { "name": "contrast:classCount", - "value": "458" + "value": "347" }, { "name": "contrast:daysObserved", @@ -21382,11 +19562,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "3.32" + "value": "40.94" }, { "name": "contrast:cisaKev", @@ -21398,7 +19578,7 @@ }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "8.0.33" }, { "name": "contrast:devStatus", @@ -21418,48 +19598,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1196-0cf51bb0751c1362a417eb59824d27d2907780d2", - "id": "CVE-2018-1196", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-21363-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2022-21363", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" }, - "score": 5.9, - "severity": "medium", - "method": "CVSSv31", - "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + "score": 0.0, + "method": "CVSSv31" } ], - "description": "Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the \"run_user\" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the \"run_user\" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.", - "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2018-1196. Latest available release is 4.1.0.", + "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2022-21363.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "5.1.42", "status": "affected" }, { - "version": "3.0.0", + "version": "8.0.33", "status": "unaffected" } ] @@ -21476,11 +19654,11 @@ }, { "name": "contrast:classesUsed", - "value": "183" + "value": "4" }, { "name": "contrast:classCount", - "value": "458" + "value": "347" }, { "name": "contrast:daysObserved", @@ -21500,7 +19678,7 @@ }, { "name": "contrast:epssPercentile", - "value": "66.4" + "value": "68.89" }, { "name": "contrast:cisaKev", @@ -21512,7 +19690,7 @@ }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "8.0.33" }, { "name": "contrast:devStatus", @@ -21532,46 +19710,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-28366-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", - "id": "CVE-2022-28366", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-22733-10f526d22f58a32a8c3af26ccb0a6f16f4649935", + "id": "CVE-2026-22733", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" }, - "score": 7.5, + "score": 8.1, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.", - "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-28366. Latest available release is 2.70.0.", + "description": "Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.", + "recommendation": "Upgrade spring-boot-starter-actuator from 1.5.4.RELEASE to 3.5.12 to remediate CVE-2026-22733. Latest available release is 4.1.0.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", + "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@1.5.4.RELEASE", "versions": [ { - "version": "2.21", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "2.61.0", + "version": "3.5.12", "status": "unaffected" } ] @@ -21592,7 +19770,7 @@ }, { "name": "contrast:classCount", - "value": "53" + "value": "0" }, { "name": "contrast:daysObserved", @@ -21608,11 +19786,11 @@ }, { "name": "contrast:epssScore", - "value": "0.02" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "80.88" + "value": "28.97" }, { "name": "contrast:cisaKev", @@ -21620,15 +19798,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", - "value": "2.70.0" + "value": "4.1.0" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -21636,7 +19814,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -21644,46 +19822,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact regardless of missing Shield coverage." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-29546-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", - "id": "CVE-2022-29546", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-27772-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2022-27772", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" }, - "score": 7.5, + "score": 7.8, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.", - "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-29546. Latest available release is 2.70.0.", + "description": "** UNSUPPORTED WHEN ASSIGNED ** spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2022-27772. Latest available release is 4.1.0.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", "versions": [ { - "version": "2.21", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "2.61.0", + "version": "3.0.0", "status": "unaffected" } ] @@ -21700,11 +19880,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "183" }, { "name": "contrast:classCount", - "value": "53" + "value": "458" }, { "name": "contrast:daysObserved", @@ -21724,7 +19904,7 @@ }, { "name": "contrast:epssPercentile", - "value": "67.25" + "value": "46.27" }, { "name": "contrast:cisaKev", @@ -21736,7 +19916,7 @@ }, { "name": "contrast:latestVersion", - "value": "2.70.0" + "value": "4.1.0" }, { "name": "contrast:devStatus", @@ -21752,52 +19932,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-25647-c4ba5371a29ac9b2ad6129b1d39ea38750043eff", - "id": "CVE-2022-25647", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-22235-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2025-22235", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" }, - "score": 7.5, + "score": 7.3, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], - "description": "The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.", - "recommendation": "Upgrade gson from 2.8.0 to 2.8.9 to remediate CVE-2022-25647. Latest available release is 2.12.1.", + "description": "EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.\n\nYour application may be affected by this if all the following conditions are met:\n\n * You use Spring Security\n * EndpointRequest.to() has been used in a Spring Security chain configuration\n * The endpoint which EndpointRequest references is disabled or not exposed via web\n * Your application handles requests to /null and this path needs protection\n\n\nYou are not affected if any of the following is true:\n\n * You don\u0027t use Spring Security\n * You don\u0027t use EndpointRequest.to()\n * The endpoint which EndpointRequest.to() refers to is enabled and is exposed\n * Your application does not handle requests to /null or this path does not need protection", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2025-22235. Latest available release is 4.1.0.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (36 of 174 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/com.google.code.gson/gson@2.8.0", + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", "versions": [ { - "version": "2.8.0", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "2.8.9", + "version": "3.0.0", "status": "unaffected" } ] @@ -21814,11 +19994,11 @@ }, { "name": "contrast:classesUsed", - "value": "36" + "value": "183" }, { "name": "contrast:classCount", - "value": "174" + "value": "458" }, { "name": "contrast:daysObserved", @@ -21834,11 +20014,11 @@ }, { "name": "contrast:epssScore", - "value": "0.12" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "95.89" + "value": "34.63" }, { "name": "contrast:cisaKev", @@ -21850,7 +20030,7 @@ }, { "name": "contrast:latestVersion", - "value": "2.13.2" + "value": "4.1.0" }, { "name": "contrast:devStatus", @@ -21866,50 +20046,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Low class usage and moderate EPSS, Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-36090-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2021-36090", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40973-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2026-40973", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" }, - "score": 7.5, + "score": 7.0, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 zip package.", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-36090. Latest available release is 1.28.0.", + "description": "A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2026-40973. Latest available release is 4.1.0.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", "versions": [ { - "version": "1.9", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "1.26.0", + "version": "3.0.0", "status": "unaffected" } ] @@ -21926,11 +20108,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "183" }, { "name": "contrast:classCount", - "value": "200" + "value": "458" }, { "name": "contrast:daysObserved", @@ -21946,11 +20128,11 @@ }, { "name": "contrast:epssScore", - "value": "0.13" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "96.04" + "value": "3.32" }, { "name": "contrast:cisaKev", @@ -21962,7 +20144,7 @@ }, { "name": "contrast:latestVersion", - "value": "1.28.0" + "value": "4.1.0" }, { "name": "contrast:devStatus", @@ -21978,50 +20160,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35516-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2021-35516", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1196-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2018-1196", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" }, - "score": 7.5, - "severity": "high", + "score": 5.9, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35516. Latest available release is 1.28.0.", + "description": "Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the \"run_user\" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the \"run_user\" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2018-1196. Latest available release is 4.1.0.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", "versions": [ { - "version": "1.9", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "1.26.0", + "version": "3.0.0", "status": "unaffected" } ] @@ -22038,11 +20222,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "183" }, { "name": "contrast:classCount", - "value": "200" + "value": "458" }, { "name": "contrast:daysObserved", @@ -22058,11 +20242,11 @@ }, { "name": "contrast:epssScore", - "value": "0.12" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "95.91" + "value": "66.4" }, { "name": "contrast:cisaKev", @@ -22074,7 +20258,7 @@ }, { "name": "contrast:latestVersion", - "value": "1.28.0" + "value": "4.1.0" }, { "name": "contrast:devStatus", @@ -22094,22 +20278,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35517-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2021-35517", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-28366-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", + "id": "CVE-2022-28366", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" }, "score": 7.5, "severity": "high", @@ -22117,23 +20301,23 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 tar package.", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35517. Latest available release is 1.28.0.", + "description": "Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.", + "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-28366. Latest available release is 2.70.0.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", "versions": [ { - "version": "1.9", + "version": "2.21", "status": "affected" }, { - "version": "1.26.0", + "version": "2.61.0", "status": "unaffected" } ] @@ -22154,7 +20338,7 @@ }, { "name": "contrast:classCount", - "value": "200" + "value": "53" }, { "name": "contrast:daysObserved", @@ -22170,11 +20354,11 @@ }, { "name": "contrast:epssScore", - "value": "0.11" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "95.47" + "value": "80.88" }, { "name": "contrast:cisaKev", @@ -22182,15 +20366,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "true" + "value": "false" }, { "name": "contrast:latestVersion", - "value": "1.28.0" + "value": "2.70.0" }, { "name": "contrast:devStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:qaStatus", @@ -22198,7 +20382,7 @@ }, { "name": "contrast:prodStatus", - "value": "NOT_SEEN" + "value": "NO_SHIELD" }, { "name": "contrast:vexAdvisorAssessment", @@ -22206,22 +20390,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35515-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2021-35515", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-29546-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", + "id": "CVE-2022-29546", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" }, "score": 7.5, "severity": "high", @@ -22229,23 +20413,23 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35515. Latest available release is 1.28.0.", + "description": "HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.", + "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-29546. Latest available release is 2.70.0.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", "versions": [ { - "version": "1.9", + "version": "2.21", "status": "affected" }, { - "version": "1.26.0", + "version": "2.61.0", "status": "unaffected" } ] @@ -22266,7 +20450,7 @@ }, { "name": "contrast:classCount", - "value": "200" + "value": "53" }, { "name": "contrast:daysObserved", @@ -22282,11 +20466,11 @@ }, { "name": "contrast:epssScore", - "value": "0.12" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "95.73" + "value": "67.25" }, { "name": "contrast:cisaKev", @@ -22298,7 +20482,7 @@ }, { "name": "contrast:latestVersion", - "value": "1.28.0" + "value": "2.70.0" }, { "name": "contrast:devStatus", @@ -22318,46 +20502,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-25710-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2024-25710", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-25647-c4ba5371a29ac9b2ad6129b1d39ea38750043eff", + "id": "CVE-2022-25647", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" }, - "score": 5.5, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.\n\nUsers are recommended to upgrade to version 1.26.0 which fixes the issue.\n\n", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2024-25710. Latest available release is 1.28.0.", + "description": "The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.", + "recommendation": "Upgrade gson from 2.8.0 to 2.8.9 to remediate CVE-2022-25647. Latest available release is 2.12.1.", "analysis": { "state": "not_affected", - "justification": "code_not_reachable", - "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + "response": [ + "update" + ], + "detail": "Library loaded (36 of 174 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "ref": "pkg:maven/com.google.code.gson/gson@2.8.0", "versions": [ { - "version": "1.9", + "version": "2.8.0", "status": "affected" }, { - "version": "1.26.0", + "version": "2.8.9", "status": "unaffected" } ] @@ -22374,11 +20560,11 @@ }, { "name": "contrast:classesUsed", - "value": "0" + "value": "36" }, { "name": "contrast:classCount", - "value": "200" + "value": "174" }, { "name": "contrast:daysObserved", @@ -22394,11 +20580,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.12" }, { "name": "contrast:epssPercentile", - "value": "36.91" + "value": "95.89" }, { "name": "contrast:cisaKev", @@ -22410,7 +20596,7 @@ }, { "name": "contrast:latestVersion", - "value": "1.28.0" + "value": "2.13.2" }, { "name": "contrast:devStatus", @@ -22426,35 +20612,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11771-cc18955ff1e36d5abd39a14bfe82b19154330a34", - "id": "CVE-2018-11771", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-36090-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-36090", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" }, - "score": 5.5, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17\u0027s ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress\u0027 zip package.", - "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2018-11771. Latest available release is 1.28.0.", + "description": "When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 zip package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-36090. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", "justification": "code_not_reachable", @@ -22506,11 +20692,11 @@ }, { "name": "contrast:epssScore", - "value": "0.05" + "value": "0.13" }, { "name": "contrast:epssPercentile", - "value": "91.97" + "value": "96.04" }, { "name": "contrast:cisaKev", @@ -22542,48 +20728,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-34169-d55d3f02a56ec4c25695fe67e1334ff8c2ecea23", - "id": "CVE-2022-34169", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35516-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35516", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.", - "recommendation": "Upgrade xalan from 2.7.2 to 2.7.3 to remediate CVE-2022-34169.", + "description": "When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35516. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (7 of 1501 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/xalan/xalan@2.7.2", + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", "versions": [ { - "version": "2.7.2", + "version": "1.9", "status": "affected" }, { - "version": "2.7.3", + "version": "1.26.0", "status": "unaffected" } ] @@ -22600,11 +20784,11 @@ }, { "name": "contrast:classesUsed", - "value": "7" + "value": "0" }, { "name": "contrast:classCount", - "value": "1501" + "value": "200" }, { "name": "contrast:daysObserved", @@ -22620,11 +20804,11 @@ }, { "name": "contrast:epssScore", - "value": "0.81" + "value": "0.12" }, { "name": "contrast:epssPercentile", - "value": "99.6" + "value": "95.91" }, { "name": "contrast:cisaKev", @@ -22636,7 +20820,7 @@ }, { "name": "contrast:latestVersion", - "value": "2.7.3" + "value": "1.28.0" }, { "name": "contrast:devStatus", @@ -22652,52 +20836,50 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "EPSS 0.81 is very high, only 7 of 1501 classes loaded but claim rests on duration not reachability, worth confirming." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1272-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-1272", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35517-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35517", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1272. Latest available release is 7.0.8.", + "description": "When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 tar package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35517. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", "versions": [ { - "version": "4.3.9.RELEASE", + "version": "1.9", "status": "affected" }, { - "version": "5.2.19.RELEASE", + "version": "1.26.0", "status": "unaffected" } ] @@ -22714,11 +20896,11 @@ }, { "name": "contrast:classesUsed", - "value": "334" + "value": "0" }, { "name": "contrast:classCount", - "value": "791" + "value": "200" }, { "name": "contrast:daysObserved", @@ -22734,11 +20916,11 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.11" }, { "name": "contrast:epssPercentile", - "value": "86.79" + "value": "95.47" }, { "name": "contrast:cisaKev", @@ -22750,7 +20932,7 @@ }, { "name": "contrast:latestVersion", - "value": "7.0.8" + "value": "1.28.0" }, { "name": "contrast:devStatus", @@ -22770,22 +20952,22 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.03), Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-15756-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-15756", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35515-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35515", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" }, "score": 7.5, "severity": "high", @@ -22793,25 +20975,23 @@ "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-15756. Latest available release is 7.0.8.", + "description": "When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35515. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", "versions": [ { - "version": "4.3.9.RELEASE", + "version": "1.9", "status": "affected" }, { - "version": "5.2.19.RELEASE", + "version": "1.26.0", "status": "unaffected" } ] @@ -22828,11 +21008,11 @@ }, { "name": "contrast:classesUsed", - "value": "334" + "value": "0" }, { "name": "contrast:classCount", - "value": "791" + "value": "200" }, { "name": "contrast:daysObserved", @@ -22848,11 +21028,11 @@ }, { "name": "contrast:epssScore", - "value": "0.09" + "value": "0.12" }, { "name": "contrast:epssPercentile", - "value": "94.98" + "value": "95.73" }, { "name": "contrast:cisaKev", @@ -22864,7 +21044,7 @@ }, { "name": "contrast:latestVersion", - "value": "7.0.8" + "value": "1.28.0" }, { "name": "contrast:devStatus", @@ -22884,48 +21064,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.09), Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41848-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2026-41848", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-25710-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2024-25710", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" }, - "score": 7.5, - "severity": "high", + "score": 5.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], - "description": "Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2026-41848. Latest available release is 7.0.8.", + "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.\n\nUsers are recommended to upgrade to version 1.26.0 which fixes the issue.\n\n", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2024-25710. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", "versions": [ { - "version": "4.3.9.RELEASE", + "version": "1.9", "status": "affected" }, { - "version": "5.2.19.RELEASE", + "version": "1.26.0", "status": "unaffected" } ] @@ -22942,11 +21120,11 @@ }, { "name": "contrast:classesUsed", - "value": "334" + "value": "0" }, { "name": "contrast:classCount", - "value": "791" + "value": "200" }, { "name": "contrast:daysObserved", @@ -22966,7 +21144,7 @@ }, { "name": "contrast:epssPercentile", - "value": "24.07" + "value": "36.91" }, { "name": "contrast:cisaKev", @@ -22978,7 +21156,7 @@ }, { "name": "contrast:latestVersion", - "value": "7.0.8" + "value": "1.28.0" }, { "name": "contrast:devStatus", @@ -22998,48 +21176,46 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11040-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-11040", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11771-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2018-11771", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" - }, - "score": 7.5, - "severity": "high", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" + }, + "score": 5.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], - "description": "Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the \"jsonp\" and \"callback\" JSONP parameters, enabling cross-domain requests.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-11040. Latest available release is 7.0.8.", + "description": "When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17\u0027s ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress\u0027 zip package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2018-11771. Latest available release is 1.28.0.", "analysis": { "state": "not_affected", - "response": [ - "update" - ], - "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", "versions": [ { - "version": "4.3.9.RELEASE", + "version": "1.9", "status": "affected" }, { - "version": "5.2.19.RELEASE", + "version": "1.26.0", "status": "unaffected" } ] @@ -23056,11 +21232,11 @@ }, { "name": "contrast:classesUsed", - "value": "334" + "value": "0" }, { "name": "contrast:classCount", - "value": "791" + "value": "200" }, { "name": "contrast:daysObserved", @@ -23076,11 +21252,11 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.05" }, { "name": "contrast:epssPercentile", - "value": "87.45" + "value": "91.97" }, { "name": "contrast:cisaKev", @@ -23092,7 +21268,7 @@ }, { "name": "contrast:latestVersion", - "value": "7.0.8" + "value": "1.28.0" }, { "name": "contrast:devStatus", @@ -23112,48 +21288,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.03), Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1257-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-1257", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-34169-d55d3f02a56ec4c25695fe67e1334ff8c2ecea23", + "id": "CVE-2022-34169", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" }, - "score": 6.5, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "description": "Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1257. Latest available release is 7.0.8.", + "description": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.", + "recommendation": "Upgrade xalan from 2.7.2 to 2.7.3 to remediate CVE-2022-34169.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (7 of 1501 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "ref": "pkg:maven/xalan/xalan@2.7.2", "versions": [ { - "version": "4.3.9.RELEASE", + "version": "2.7.2", "status": "affected" }, { - "version": "5.2.19.RELEASE", + "version": "2.7.3", "status": "unaffected" } ] @@ -23170,11 +21346,11 @@ }, { "name": "contrast:classesUsed", - "value": "334" + "value": "7" }, { "name": "contrast:classCount", - "value": "791" + "value": "1501" }, { "name": "contrast:daysObserved", @@ -23190,11 +21366,11 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.81" }, { "name": "contrast:epssPercentile", - "value": "87.42" + "value": "99.6" }, { "name": "contrast:cisaKev", @@ -23206,7 +21382,7 @@ }, { "name": "contrast:latestVersion", - "value": "7.0.8" + "value": "2.7.3" }, { "name": "contrast:devStatus", @@ -23222,35 +21398,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "Flagged: HIGH severity, EPSS 0.81 - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1271-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-1271", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1272-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1272", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" }, - "score": 5.9, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1271. Latest available release is 7.0.8.", + "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1272. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -23304,11 +21480,11 @@ }, { "name": "contrast:epssScore", - "value": "0.35" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "98.3" + "value": "86.79" }, { "name": "contrast:cisaKev", @@ -23336,35 +21512,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity keeps stakes manageable despite EPSS 0.35." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1199-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2018-1199", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-15756-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-15756", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" }, - "score": 5.3, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1199. Latest available release is 7.0.8.", + "description": "Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-15756. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -23418,11 +21594,11 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.09" }, { "name": "contrast:epssPercentile", - "value": "85.69" + "value": "94.98" }, { "name": "contrast:cisaKev", @@ -23450,35 +21626,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-22096-430b7298bfb85d66fb61e19ca8f06231b911e9f5", - "id": "CVE-2021-22096", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41848-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2026-41848", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" }, - "score": 4.3, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.", - "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2021-22096. Latest available release is 7.0.8.", + "description": "Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2026-41848. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -23532,11 +21708,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "69.88" + "value": "24.07" }, { "name": "contrast:cisaKev", @@ -23564,52 +21740,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41850-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2026-41850", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11040-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-11040", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" }, "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41850. Latest available release is 7.0.8.", + "description": "Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the \"jsonp\" and \"callback\" JSONP parameters, enabling cross-domain requests.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-11040. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", "versions": [ { "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.3.39", + "version": "5.2.19.RELEASE", "status": "unaffected" } ] @@ -23626,11 +21802,11 @@ }, { "name": "contrast:classesUsed", - "value": "91" + "value": "334" }, { "name": "contrast:classCount", - "value": "142" + "value": "791" }, { "name": "contrast:daysObserved", @@ -23646,11 +21822,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "28.94" + "value": "87.45" }, { "name": "contrast:cisaKev", @@ -23678,52 +21854,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41851-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2026-41851", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1257-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1257", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" }, - "score": 7.5, - "severity": "high", + "score": 6.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41851. Latest available release is 7.0.8.", + "description": "Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1257. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", "versions": [ { "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.3.39", + "version": "5.2.19.RELEASE", "status": "unaffected" } ] @@ -23740,11 +21916,11 @@ }, { "name": "contrast:classesUsed", - "value": "91" + "value": "334" }, { "name": "contrast:classCount", - "value": "142" + "value": "791" }, { "name": "contrast:daysObserved", @@ -23760,11 +21936,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "28.94" + "value": "87.42" }, { "name": "contrast:cisaKev", @@ -23796,48 +21972,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41849-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2026-41849", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1271-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1271", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" }, - "score": 7.5, - "severity": "high", + "score": 5.9, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41849. Latest available release is 7.0.8.", + "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1271. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", "versions": [ { "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.3.39", + "version": "5.2.19.RELEASE", "status": "unaffected" } ] @@ -23854,11 +22030,11 @@ }, { "name": "contrast:classesUsed", - "value": "91" + "value": "334" }, { "name": "contrast:classCount", - "value": "142" + "value": "791" }, { "name": "contrast:daysObserved", @@ -23874,11 +22050,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.35" }, { "name": "contrast:epssPercentile", - "value": "17.87" + "value": "98.3" }, { "name": "contrast:cisaKev", @@ -23910,48 +22086,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20863-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2023-20863", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1199-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1199", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" }, - "score": 6.5, + "score": 5.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], - "description": "In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20863. Latest available release is 7.0.8.", + "description": "Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1199. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", "versions": [ { "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.3.39", + "version": "5.2.19.RELEASE", "status": "unaffected" } ] @@ -23968,11 +22144,11 @@ }, { "name": "contrast:classesUsed", - "value": "91" + "value": "334" }, { "name": "contrast:classCount", - "value": "142" + "value": "791" }, { "name": "contrast:daysObserved", @@ -23988,11 +22164,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "63.96" + "value": "85.69" }, { "name": "contrast:cisaKev", @@ -24024,48 +22200,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20861-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2023-20861", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-22096-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2021-22096", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" }, - "score": 6.5, + "score": 4.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], - "description": "In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20861. Latest available release is 7.0.8.", + "description": "In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2021-22096. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", "versions": [ { "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.3.39", + "version": "5.2.19.RELEASE", "status": "unaffected" } ] @@ -24082,11 +22258,11 @@ }, { "name": "contrast:classesUsed", - "value": "91" + "value": "334" }, { "name": "contrast:classCount", - "value": "142" + "value": "791" }, { "name": "contrast:daysObserved", @@ -24106,7 +22282,7 @@ }, { "name": "contrast:epssPercentile", - "value": "59.52" + "value": "69.88" }, { "name": "contrast:cisaKev", @@ -24138,31 +22314,31 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22950-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2022-22950", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41850-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41850", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" }, - "score": 6.5, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2022-22950. Latest available release is 7.0.8.", + "description": "Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41850. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -24216,11 +22392,11 @@ }, { "name": "contrast:epssScore", - "value": "0.36" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "98.36" + "value": "28.94" }, { "name": "contrast:cisaKev", @@ -24248,35 +22424,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity keeps stakes manageable despite EPSS 0.36." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41852-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2026-41852", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41851-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41851", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" }, - "score": 5.3, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41852. Latest available release is 7.0.8.", + "description": "Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41851. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -24334,7 +22510,7 @@ }, { "name": "contrast:epssPercentile", - "value": "7.34" + "value": "28.94" }, { "name": "contrast:cisaKev", @@ -24362,35 +22538,35 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38808-4edca6913da9e62a6586714e053e01a61952a153", - "id": "CVE-2024-38808", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41849-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41849", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" }, - "score": 4.3, - "severity": "medium", + "score": 7.5, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.\n\nSpecifically, an application is vulnerable when the following is true:\n\n * The application evaluates user-supplied SpEL expressions.", - "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2024-38808. Latest available release is 7.0.8.", + "description": "An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41849. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ @@ -24444,11 +22620,11 @@ }, { "name": "contrast:epssScore", - "value": "0.01" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "44.84" + "value": "17.87" }, { "name": "contrast:cisaKev", @@ -24476,52 +22652,52 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20883-5591fa7358d950f374532c7d92dccf113ebfa1bb", - "id": "CVE-2023-20883", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20863-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2023-20863", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" }, - "score": 7.5, - "severity": "high", + "score": 6.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.", - "recommendation": "Upgrade spring-boot-autoconfigure from 1.5.4.RELEASE to 2.5.15 to remediate CVE-2023-20883. Latest available release is 4.1.0.", + "description": "In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20863. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (195 of 848 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@1.5.4.RELEASE", + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "versions": [ { - "version": "1.5.4.RELEASE", + "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "2.5.15", + "version": "5.3.39", "status": "unaffected" } ] @@ -24538,11 +22714,11 @@ }, { "name": "contrast:classesUsed", - "value": "195" + "value": "91" }, { "name": "contrast:classCount", - "value": "848" + "value": "142" }, { "name": "contrast:daysObserved", @@ -24562,7 +22738,7 @@ }, { "name": "contrast:epssPercentile", - "value": "57.6" + "value": "63.96" }, { "name": "contrast:cisaKev", @@ -24574,7 +22750,7 @@ }, { "name": "contrast:latestVersion", - "value": "4.1.0" + "value": "7.0.8" }, { "name": "contrast:devStatus", @@ -24594,48 +22770,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.01), Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-13935-a92b066b0ea9ee1cb05b7d5e4bfed4ad8898f741", - "id": "CVE-2020-13935", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20861-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2023-20861", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13935" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13935" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" }, - "score": 7.5, - "severity": "high", + "score": 6.5, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.", - "recommendation": "Upgrade tomcat-embed-websocket from 8.5.15 to 8.0.32 to remediate CVE-2020-13935. Latest available release is 10.1.4.", + "description": "In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20861. Latest available release is 7.0.8.", "analysis": { - "state": "in_triage", + "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (25 of 168 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15", + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "versions": [ { - "version": "8.5.15", + "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "8.0.32", + "version": "5.3.39", "status": "unaffected" } ] @@ -24652,11 +22828,11 @@ }, { "name": "contrast:classesUsed", - "value": "25" + "value": "91" }, { "name": "contrast:classCount", - "value": "168" + "value": "142" }, { "name": "contrast:daysObserved", @@ -24672,11 +22848,11 @@ }, { "name": "contrast:epssScore", - "value": "0.87" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "99.72" + "value": "59.52" }, { "name": "contrast:cisaKev", @@ -24684,15 +22860,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", - "value": "11.0.24" + "value": "7.0.8" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -24700,56 +22876,56 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", - "value": "needs_review" + "value": "sound" }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, EPSS 0.87, in_triage with no CVE Shield coverage at all, no active backstop possible." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-23672-a92b066b0ea9ee1cb05b7d5e4bfed4ad8898f741", - "id": "CVE-2024-23672", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22950-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2022-22950", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" }, - "score": 6.3, + "score": 6.5, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", - "recommendation": "Upgrade tomcat-embed-websocket from 8.5.15 to 8.0.32 to remediate CVE-2024-23672. Latest available release is 10.1.4.", + "description": "n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2022-22950. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (25 of 168 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15", + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "versions": [ { - "version": "8.5.15", + "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "8.0.32", + "version": "5.3.39", "status": "unaffected" } ] @@ -24766,11 +22942,11 @@ }, { "name": "contrast:classesUsed", - "value": "25" + "value": "91" }, { "name": "contrast:classCount", - "value": "168" + "value": "142" }, { "name": "contrast:daysObserved", @@ -24786,11 +22962,11 @@ }, { "name": "contrast:epssScore", - "value": "0.02" + "value": "0.36" }, { "name": "contrast:epssPercentile", - "value": "82.23" + "value": "98.36" }, { "name": "contrast:cisaKev", @@ -24802,7 +22978,7 @@ }, { "name": "contrast:latestVersion", - "value": "11.0.24" + "value": "7.0.8" }, { "name": "contrast:devStatus", @@ -24822,48 +22998,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-25638-7e1217f0df943561766b715ffb6cb1d270f3b715", - "id": "CVE-2020-25638", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41852-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41852", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" }, - "score": 7.4, - "severity": "high", + "score": 5.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], - "description": "A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.", - "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2020-25638. Latest available release is 5.4.33.", + "description": "A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41852. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "versions": [ { - "version": "5.0.4.Final", + "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.5.6", + "version": "5.3.39", "status": "unaffected" } ] @@ -24880,11 +23056,11 @@ }, { "name": "contrast:classesUsed", - "value": "1563" + "value": "91" }, { "name": "contrast:classCount", - "value": "3787" + "value": "142" }, { "name": "contrast:daysObserved", @@ -24900,11 +23076,11 @@ }, { "name": "contrast:epssScore", - "value": "0.03" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "86.13" + "value": "7.34" }, { "name": "contrast:cisaKev", @@ -24916,7 +23092,7 @@ }, { "name": "contrast:latestVersion", - "value": "7.2.5.Final" + "value": "7.0.8" }, { "name": "contrast:devStatus", @@ -24936,48 +23112,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low EPSS (0.03), Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14900-7e1217f0df943561766b715ffb6cb1d270f3b715", - "id": "CVE-2019-14900", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38808-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2024-38808", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" }, - "score": 6.5, + "score": 4.3, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], - "description": "A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.", - "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2019-14900. Latest available release is 5.4.33.", + "description": "In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.\n\nSpecifically, an application is vulnerable when the following is true:\n\n * The application evaluates user-supplied SpEL expressions.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2024-38808. Latest available release is 7.0.8.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "versions": [ { - "version": "5.0.4.Final", + "version": "4.3.9.RELEASE", "status": "affected" }, { - "version": "5.5.6", + "version": "5.3.39", "status": "unaffected" } ] @@ -24994,11 +23170,11 @@ }, { "name": "contrast:classesUsed", - "value": "1563" + "value": "91" }, { "name": "contrast:classCount", - "value": "3787" + "value": "142" }, { "name": "contrast:daysObserved", @@ -25014,11 +23190,11 @@ }, { "name": "contrast:epssScore", - "value": "0.02" + "value": "0.01" }, { "name": "contrast:epssPercentile", - "value": "80.65" + "value": "44.84" }, { "name": "contrast:cisaKev", @@ -25030,7 +23206,7 @@ }, { "name": "contrast:latestVersion", - "value": "7.2.5.Final" + "value": "7.0.8" }, { "name": "contrast:devStatus", @@ -25050,48 +23226,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-35036-0622a9bcef2eed6d41b5b8e0662c36212009e375", - "id": "CVE-2025-35036", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20883-5591fa7358d950f374532c7d92dccf113ebfa1bb", + "id": "CVE-2023-20883", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35036" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35036" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" }, - "score": 7.3, + "score": 7.5, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "description": "Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.", - "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2025-35036.", + "description": "In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.", + "recommendation": "Upgrade spring-boot-autoconfigure from 1.5.4.RELEASE to 2.5.15 to remediate CVE-2023-20883. Latest available release is 4.1.0.", "analysis": { - "state": "in_triage", + "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "detail": "Library loaded (195 of 848 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", + "ref": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@1.5.4.RELEASE", "versions": [ { - "version": "5.3.5.Final", + "version": "1.5.4.RELEASE", "status": "affected" }, { - "version": "8.0.2.Final", + "version": "2.5.15", "status": "unaffected" } ] @@ -25108,11 +23284,11 @@ }, { "name": "contrast:classesUsed", - "value": "225" + "value": "195" }, { "name": "contrast:classCount", - "value": "459" + "value": "848" }, { "name": "contrast:daysObserved", @@ -25132,7 +23308,7 @@ }, { "name": "contrast:epssPercentile", - "value": "50.61" + "value": "57.6" }, { "name": "contrast:cisaKev", @@ -25140,15 +23316,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", - "value": "8.0.2.Final" + "value": "4.1.0" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -25156,7 +23332,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -25164,48 +23340,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "High severity, in_triage with no CVE Shield coverage at all." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-7536-0622a9bcef2eed6d41b5b8e0662c36212009e375", - "id": "CVE-2017-7536", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-23672-a92b066b0ea9ee1cb05b7d5e4bfed4ad8898f741", + "id": "CVE-2024-23672", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" }, - "score": 7.0, - "severity": "high", + "score": 6.3, + "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" } ], - "description": "In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager\u0027s reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().", - "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2017-7536.", + "description": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-websocket from 8.5.15 to 8.0.32 to remediate CVE-2024-23672. Latest available release is 10.1.4.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (25 of 168 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15", "versions": [ { - "version": "5.3.5.Final", + "version": "8.5.15", "status": "affected" }, { - "version": "8.0.2.Final", + "version": "8.0.32", "status": "unaffected" } ] @@ -25222,11 +23398,11 @@ }, { "name": "contrast:classesUsed", - "value": "225" + "value": "25" }, { "name": "contrast:classCount", - "value": "459" + "value": "168" }, { "name": "contrast:daysObserved", @@ -25242,11 +23418,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.02" }, { "name": "contrast:epssPercentile", - "value": "39.71" + "value": "82.23" }, { "name": "contrast:cisaKev", @@ -25258,7 +23434,7 @@ }, { "name": "contrast:latestVersion", - "value": "8.0.2.Final" + "value": "11.0.24" }, { "name": "contrast:devStatus", @@ -25278,48 +23454,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, Shield coverage present." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-1932-0622a9bcef2eed6d41b5b8e0662c36212009e375", - "id": "CVE-2023-1932", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-25638-7e1217f0df943561766b715ffb6cb1d270f3b715", + "id": "CVE-2020-25638", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1932" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1932" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" }, - "score": 6.1, - "severity": "medium", + "score": 7.4, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "A flaw was found in hibernate-validator\u0027s \u0027isValid\u0027 method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.", - "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2023-1932.", + "description": "A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.", + "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2020-25638. Latest available release is 5.4.33.", "analysis": { - "state": "in_triage", + "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", + "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", "versions": [ { - "version": "5.3.5.Final", + "version": "5.0.4.Final", "status": "affected" }, { - "version": "8.0.2.Final", + "version": "5.5.6", "status": "unaffected" } ] @@ -25336,11 +23512,11 @@ }, { "name": "contrast:classesUsed", - "value": "225" + "value": "1563" }, { "name": "contrast:classCount", - "value": "459" + "value": "3787" }, { "name": "contrast:daysObserved", @@ -25356,11 +23532,11 @@ }, { "name": "contrast:epssScore", - "value": "0.0" + "value": "0.03" }, { "name": "contrast:epssPercentile", - "value": "38.53" + "value": "86.13" }, { "name": "contrast:cisaKev", @@ -25368,15 +23544,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", - "value": "8.0.2.Final" + "value": "7.2.5.Final" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -25384,56 +23560,56 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no Shield coverage, but low stakes." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-10693-0622a9bcef2eed6d41b5b8e0662c36212009e375", - "id": "CVE-2020-10693", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14900-7e1217f0df943561766b715ffb6cb1d270f3b715", + "id": "CVE-2019-14900", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10693" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10693" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" }, - "score": 5.3, + "score": 6.5, "severity": "medium", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "description": "A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.", - "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2020-10693.", + "description": "A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.", + "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2019-14900. Latest available release is 5.4.33.", "analysis": { - "state": "in_triage", + "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", + "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", "versions": [ { - "version": "5.3.5.Final", + "version": "5.0.4.Final", "status": "affected" }, { - "version": "8.0.2.Final", + "version": "5.5.6", "status": "unaffected" } ] @@ -25450,11 +23626,11 @@ }, { "name": "contrast:classesUsed", - "value": "225" + "value": "1563" }, { "name": "contrast:classCount", - "value": "459" + "value": "3787" }, { "name": "contrast:daysObserved", @@ -25474,7 +23650,7 @@ }, { "name": "contrast:epssPercentile", - "value": "82.07" + "value": "80.65" }, { "name": "contrast:cisaKev", @@ -25482,15 +23658,15 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", - "value": "8.0.2.Final" + "value": "7.2.5.Final" }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -25498,7 +23674,7 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", @@ -25506,48 +23682,48 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no Shield coverage, but low stakes." + "value": "sound" } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-2976-6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9", - "id": "CVE-2023-2976", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-7536-0622a9bcef2eed6d41b5b8e0662c36212009e375", + "id": "CVE-2017-7536", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" }, - "score": 7.1, + "score": 7.0, "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "description": "Use of Java\u0027s default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.\n\nEven though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.\n\n", - "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2023-2976.", + "description": "In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager\u0027s reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().", + "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2017-7536.", "analysis": { "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { - "ref": "pkg:maven/com.google.guava/guava@19.0", + "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", "versions": [ { - "version": "19.0", + "version": "5.3.5.Final", "status": "affected" }, { - "version": "33.6.0-jre", + "version": "8.0.2.Final", "status": "unaffected" } ] @@ -25564,11 +23740,11 @@ }, { "name": "contrast:classesUsed", - "value": "5" + "value": "225" }, { "name": "contrast:classCount", - "value": "1717" + "value": "459" }, { "name": "contrast:daysObserved", @@ -25588,7 +23764,7 @@ }, { "name": "contrast:epssPercentile", - "value": "15.93" + "value": "39.71" }, { "name": "contrast:cisaKev", @@ -25600,7 +23776,7 @@ }, { "name": "contrast:latestVersion", - "value": "33.6.0-jre" + "value": "8.0.2.Final" }, { "name": "contrast:devStatus", @@ -25616,41 +23792,41 @@ }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Negligible EPSS, minimal class usage (5 of 1717), Shield coverage present." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, { - "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-10237-6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9", - "id": "CVE-2018-10237", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-2976-6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9", + "id": "CVE-2023-2976", "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" }, "ratings": [ { "source": { "name": "NVD", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237" + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" }, - "score": 5.9, - "severity": "medium", + "score": 7.1, + "severity": "high", "method": "CVSSv31", - "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], - "description": "Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.", - "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2018-10237.", + "description": "Use of Java\u0027s default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.\n\nEven though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.\n\n", + "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2023-2976.", "analysis": { - "state": "in_triage", + "state": "not_affected", "response": [ "update" ], - "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring. CVE Shield has no coverage for this CVE in this environment scope, so there is no detection mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by elapsed time alone, regardless of the 30-day threshold." + "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." }, "affects": [ { @@ -25698,11 +23874,11 @@ }, { "name": "contrast:epssScore", - "value": "0.05" + "value": "0.0" }, { "name": "contrast:epssPercentile", - "value": "91.8" + "value": "15.93" }, { "name": "contrast:cisaKev", @@ -25710,7 +23886,7 @@ }, { "name": "contrast:shieldAvailable", - "value": "false" + "value": "true" }, { "name": "contrast:latestVersion", @@ -25718,7 +23894,7 @@ }, { "name": "contrast:devStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:qaStatus", @@ -25726,15 +23902,15 @@ }, { "name": "contrast:prodStatus", - "value": "NO_SHIELD" + "value": "NOT_SEEN" }, { "name": "contrast:vexAdvisorAssessment", - "value": "sound" + "value": "needs_review" }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, in_triage with no Shield coverage, but low stakes." + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." } ] }, @@ -25848,7 +24024,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, low EPSS." + "value": "sound" } ] }, @@ -25960,7 +24136,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, moderate EPSS but low stakes given severity classification." + "value": "sound" } ] }, @@ -26072,7 +24248,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low stakes despite EPSS 0.25." + "value": "sound" } ] }, @@ -26186,7 +24362,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, moderate EPSS." + "value": "sound" } ] }, @@ -26300,7 +24476,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, @@ -26414,7 +24590,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, @@ -26526,7 +24702,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -26638,7 +24814,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -26750,7 +24926,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -26862,7 +25038,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -26974,7 +25150,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -27086,7 +25262,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -27198,7 +25374,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -27310,7 +25486,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact, commons-lang3 instance." + "value": "sound" } ] }, @@ -27422,7 +25598,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact, commons-lang3 instance." + "value": "sound" } ] }, @@ -27536,7 +25712,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, @@ -27650,7 +25826,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, @@ -27764,7 +25940,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS." + "value": "sound" } ] }, @@ -27878,7 +26054,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, low EPSS, spring-context instance." + "value": "sound" } ] }, @@ -27992,7 +26168,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Low severity, negligible EPSS." + "value": "sound" } ] }, @@ -28104,7 +26280,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -28216,7 +26392,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -28328,7 +26504,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "code_not_reachable, zero classes loaded, structural fact." + "value": "sound" } ] }, @@ -28442,7 +26618,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Medium severity, negligible EPSS." + "value": "sound" } ] }, @@ -28554,7 +26730,7 @@ }, { "name": "contrast:vexAdvisorRationale", - "value": "Unknown severity, low EPSS." + "value": "sound" } ] } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java index 92dd0c8..9c1e895 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -18,75 +18,77 @@ import com.google.gson.JsonObject; /** - * AI-powered review of a CycloneDX VEX document produced by VEXGenerator - not a second - * opinion on whether the CVE exists (Contrast's runtime data already establishes that), - * but a sanity check on whether each "not_affected"/"in_triage" CLAIM is well-supported - * given the CVE's severity/exploitability, or whether a human should look at it before - * relying on it. + * Review of a CycloneDX VEX document produced by VEXGenerator - not a second opinion on whether the CVE + * exists (Contrast's runtime data already establishes that), but a sanity check on whether each + * "not_affected"/"in_triage" CLAIM is well-supported given the CVE's severity/exploitability, or whether a + * human should look at it before relying on it. + * + * WHICH claims need review is decided deterministically (see needsReview()), not by an AI call - every input + * (severity, CISA KEV, EPSS, Assess/ADR enablement, CVE Shield coverage) is already a plain fact sitting on the + * VEX itself, so classifying it per-statement over an AI round-trip added cost and multi-minute latency + * without adding judgment, and made the same VEX produce a different flagged count from run to run on + * identical input - a liability for something meant to be relied on. The one AI call per app is used only for + * the narrative (application_description/risk_level/risk_rationale/recommendation), synthesizing what the + * already-decided facts mean in prose. * * Usage: * java -jar runtime-analyst.jar vex-advisor vex.json [-v] [-o report.md] [--json out.json] [--no-confirm] */ public class VEXAdvisor { + /** + * Which VEX statements are worth a human's attention before being relied on. Deterministic, not an AI call - + * every input here (state/justification, severity, CISA KEV, EPSS, Assess/ADR enablement) is already a plain + * fact sitting on the statement or its app, so classifying it 235 times over an AI round-trip added latency + * and cost without adding judgment: it also made the same VEX produce a different flagged count from run to + * run (21, then 61, then 125, all on identical input), which is a liability for something meant to be relied + * on. The AI's role is now the app-level narrative only - synthesizing what these facts mean in prose, not + * deciding what the facts are. + */ + private boolean needsReview(VexStatement s, AppEntry entry) { + if (s.justification != null) return false; // code_not_reachable / protected_at_runtime - structural, always sound + if ("in_triage".equals(s.state) && s.daysObserved < s.acceptAfterDays) return false; // genuinely still early + boolean assessBlind = isAssessBlind(s, entry); + boolean highSeverity = s.severity != null + && ("critical".equalsIgnoreCase(s.severity) || "high".equalsIgnoreCase(s.severity)); + boolean kev = Boolean.TRUE.equals(s.cisaKev); + boolean highEpss = s.epssScore != null && s.epssScore >= 0.5; + return assessBlind || highSeverity || kev || highEpss; + } + + /** + * Whether Assess had no runtime data anywhere in the environment(s) this claim's evidence spans - a claim + * scoped to ALL (dev/qa/prod combined, the default) is only "blind" if every one of the three lacks data; + * one --env-scoped claim is blind only if that specific environment lacks data. + */ + private boolean isAssessBlind(VexStatement s, AppEntry entry) { + String scope = s.envFilter != null ? s.envFilter : "ALL"; + if ("DEVELOPMENT".equals(scope)) return !"true".equals(entry.assessEnabledDev); + if ("QA".equals(scope)) return !"true".equals(entry.assessEnabledQa); + if ("PRODUCTION".equals(scope)) return !"true".equals(entry.assessEnabledProd); + return !"true".equals(entry.assessEnabledDev) + && !"true".equals(entry.assessEnabledQa) + && !"true".equals(entry.assessEnabledProd); + } + private static final String ANALYSIS_PROMPT = - "You are an application security analyst reviewing a set of VEX (Vulnerability Exploitability eXchange) " + - "claims that a tool generated automatically from Contrast Security runtime observability data, for ONE " + - "application.\n\n" + - "Each claim already has a CycloneDX analysis.state (not_affected or in_triage) and a justification/detail " + - "explaining WHY the tool made that claim (e.g. the library's classes were never loaded at runtime, or the " + - "vulnerable code path hasn't executed in N days of observation). Your job is NOT to re-derive the CVE - it " + - "is to judge whether relying on each claim, as stated, is reasonable given the CVE's severity/exploitability, " + - "or whether it's the kind of claim a human reviewer should double-check before trusting it.\n\n" + - "You're also given whether Assess (the module that produces the runtime evidence every claim rests on) and " + - "ADR (the classic HTTP-rule-based RASP module, formerly branded \"Protect\" - distinct from CVE Shield) " + - "are enabled per environment for this application, and whether CVE Shield itself has any coverage for " + - "each specific CVE at all (a per-CVE, product-level fact - not something that varies by environment). " + - "Weigh all of this directly: a duration-based claim scoped " + - "to an environment where Assess has no data or is disabled isn't weak evidence, it's NO evidence - flag " + - "it regardless of severity. A claim where CVE Shield has no coverage for that CVE at all is weaker still " + - "than one where Shield exists and simply hasn't fired - \"we haven't seen it\" means less when nothing " + - "was capable of catching it in the first place. A claim in an environment where ADR is disabled has one " + - "less active mitigating control as a backstop if the absence-of-execution reasoning turns out wrong, " + - "which raises the stakes of getting it wrong.\n\n" + - "## What makes a claim worth flagging for review\n\n" + - "- Any duration-based claim scoped to an environment where Assess has no data or is disabled - there is no " + - "runtime evidence behind it at all, regardless of the CVE's severity.\n" + - "- A duration-based claim on a CRITICAL/HIGH severity CVE where CVE Shield has no coverage at all for that " + - "CVE - there's no possibility of an active backstop catching an exploit attempt, so the claim rests " + - "entirely on absence-of-execution.\n" + - "- A `not_affected` claim justified only by \"N days without observed execution\" (not by code_not_reachable " + - "or protected_at_runtime) on a CRITICAL/HIGH severity CVE, especially one with a high EPSS score or KEV " + - "(known-exploited) status - absence of evidence is weaker evidence the more severe/exploitable the CVE is.\n" + - "- An `in_triage` claim on a CRITICAL/HIGH severity CVE with very few days observed so far - not wrong, but " + - "worth surfacing as still-open risk rather than letting it sit silently.\n" + - "- Anything where the day count looks barely over the acceptance threshold rather than comfortably past it.\n\n" + - "## What's normally fine as-is\n\n" + - "- `code_not_reachable` (zero classes of the library ever loaded) - this is a structural fact, not a " + - "probabilistic one, regardless of severity.\n" + - "- `protected_at_runtime` (CVE Shield actively mitigating) - an active control, not an absence of " + - "evidence.\n" + - "- Low/medium severity CVEs accepted on duration alone - lower stakes if the absence-of-evidence reasoning " + - "turns out wrong.\n\n" + - "## Your Task - Output\n\n" + + "You are an application security analyst writing a short narrative summary of a VEX (Vulnerability " + + "Exploitability eXchange) claim set that a tool generated automatically from Contrast Security runtime " + + "observability data, for ONE application. Which specific claims need review has ALREADY been decided " + + "deterministically (rule: duration-based claims on a CRITICAL/HIGH severity, CISA KEV-listed, or " + + "high-EPSS CVE, or where Assess itself had no runtime data to back the claim) - you're given that list, " + + "not asked to re-derive it. Your job is to turn the given facts into a clear, specific narrative: what's " + + "in this VEX, what's actually worth a second look and why, and what to do about it.\n\n" + "Return JSON:\n" + "```json\n" + "{\n" + - " \"application_description\": \"2-3 sentence overview of this application's VEX posture - how many claims, \"\n" + - " + \"how sound they generally look\",\n" + + " \"application_description\": \"2-3 sentence overview of this application's VEX posture - how many \"\n" + + " + \"claims, how sound they generally look\",\n" + " \"risk_level\": \"CRITICAL|HIGH|MEDIUM|LOW|SOUND\",\n" + - " \"risk_rationale\": \"Why this level, referencing the specific claims that drove it\",\n" + - " \"recommendation\": \"Specific next action - e.g. which CVEs need a human look before relying on this VEX\",\n" + - " \"statements\": [\n" + - " {\n" + - " \"cve_id\": \"CVE ID exactly as given\",\n" + - " \"assessment\": \"sound|needs_review\",\n" + - " \"rationale\": \"1-2 sentences on why this specific claim is or isn't safe to rely on as-is\"\n" + - " }\n" + - " ]\n" + + " \"risk_rationale\": \"Why this level, naming the specific flagged CVEs/libraries that drove it\",\n" + + " \"recommendation\": \"Specific next action - which CVEs need a human look first, and why those\"\n" + "}\n" + - "```\n\n" + - "Include exactly one entry in \"statements\" for each claim given below, keyed by its CVE ID.\n"; + "```\n"; static class VexStatement { String cveId; @@ -101,6 +103,7 @@ static class VexStatement { Double epssPercentile; Boolean cisaKev; Boolean shieldAvailable; + String envFilter; // "ALL", "DEVELOPMENT", "QA", or "PRODUCTION" - which env(s) this claim's evidence spans long classesUsed; long classCount; long daysObserved; @@ -166,7 +169,7 @@ private void run(String vexPath, boolean verbose, String output, String jsonOut, } ClaudeClient client = new ClaudeClient(); - double estimatedCost = client.estimateCost(entries.size(), 2000, 800); + double estimatedCost = client.estimateCost(entries.size(), 1000, 2500); if (!ClaudeClient.confirmCost(estimatedCost, entries.size(), noConfirm)) { System.out.println("Cancelled."); return; @@ -184,14 +187,13 @@ private void run(String vexPath, boolean verbose, String output, String jsonOut, result.addProperty("application", entry.name); result.addProperty("risk_level", "ERROR"); result.addProperty("application_description", String.valueOf(e.getMessage())); - result.add("statements", new JsonArray()); } results.add(result); String risk = getString(result, "risk_level", "UNKNOWN"); System.out.println(" [" + risk + "] " + entry.name + " (" + entry.statements.size() + " statement(s))"); } - int written = writeAssessmentsToVex(vexPath, results); + int written = writeAssessmentsToVex(vexPath, entries); if (written > 0) { System.out.println(" Wrote " + written + " assessment(s) back into " + vexPath); } @@ -263,6 +265,7 @@ private List parseVex(String path) throws IOException { s.cisaKev = cisaProp != null ? Boolean.parseBoolean(cisaProp) : null; String shieldProp = props.get("contrast:shieldAvailable"); s.shieldAvailable = shieldProp != null && !shieldProp.isEmpty() ? Boolean.parseBoolean(shieldProp) : null; + s.envFilter = props.getOrDefault("contrast:envFilter", "ALL"); byApp.computeIfAbsent(appName, k -> { AppEntry e = new AppEntry(); @@ -342,30 +345,37 @@ private String formatAppForAi(AppEntry entry) { .append(formatEnvFlags(entry.assessEnabledDev, entry.assessEnabledQa, entry.assessEnabledProd)).append("\n"); sb.append("ADR enabled (classic RASP module, formerly \"Protect\" - not CVE Shield): ") .append(formatEnvFlags(entry.adrEnabledDev, entry.adrEnabledQa, entry.adrEnabledProd)).append("\n\n"); - sb.append("VEX Claims:"); + List flagged = new ArrayList<>(); + int sound = 0; for (VexStatement s : entry.statements) { - sb.append("\n\n--- ").append(s.cveId).append(" ---\n"); - sb.append("Library: ").append(s.purl != null ? s.purl : "unknown").append("\n"); - sb.append("Severity: ").append(s.severity != null ? s.severity : "unknown") - .append(s.score != null ? " (score " + s.score + ")" : "").append("\n"); - if (s.epssScore != null) { - sb.append("EPSS: ").append(s.epssScore) - .append(s.epssPercentile != null ? " (percentile " + s.epssPercentile + ")" : "").append("\n"); - } - if (s.cisaKev != null) { - sb.append("CISA Known Exploited Vulnerabilities (KEV) catalog: ").append(s.cisaKev ? "YES" : "no").append("\n"); - } - if (s.shieldAvailable != null) { - sb.append("CVE Shield has coverage for this CVE at all (org-wide fact): ") - .append(s.shieldAvailable ? "YES" : "NO - no virtual patch coverage at all").append("\n"); + if (needsReview(s, entry)) flagged.add(s); + else sound++; + } + + sb.append("Total claims: ").append(entry.statements.size()) + .append(" (sound: ").append(sound).append(", flagged for review: ").append(flagged.size()).append(")\n\n"); + + if (flagged.isEmpty()) { + sb.append("No claims were flagged - every claim is either structural (library unused / CVE Shield ") + .append("actively mitigating) or duration-based on a low/medium-severity, non-KEV, low-EPSS CVE ") + .append("with real Assess data backing it.\n"); + } else { + sb.append("Claims flagged for review (already decided deterministically - explain what's actually ") + .append("going on with these in your narrative, don't just restate the reason tag):\n"); + for (VexStatement s : flagged) { + sb.append("\n- ").append(s.cveId).append(" on ").append(s.purl != null ? s.purl : "unknown library") + .append(" (").append(s.severity != null ? s.severity : "unknown severity") + .append(s.score != null ? ", score " + s.score : "").append(")"); + List tags = new ArrayList<>(); + if (isAssessBlind(s, entry)) tags.add("Assess has no data here"); + if (Boolean.TRUE.equals(s.cisaKev)) tags.add("CISA KEV"); + if (s.epssScore != null && s.epssScore >= 0.5) tags.add("EPSS " + s.epssScore); + if (!tags.isEmpty()) sb.append(" [").append(String.join(", ", tags)).append("]"); + sb.append(" - ").append(s.state).append(", ").append(s.daysObserved).append(" days observed"); + if (s.recommendation != null) sb.append(". Recommendation on record: ").append(s.recommendation); } - sb.append("Claimed state: ").append(s.state).append("\n"); - if (s.justification != null) sb.append("Justification: ").append(s.justification).append("\n"); - sb.append("Detail: ").append(s.detail != null ? s.detail : "(none)").append("\n"); - if (s.recommendation != null) sb.append("Recommendation on record: ").append(s.recommendation).append("\n"); - sb.append("Classes used: ").append(s.classesUsed).append(" of ").append(s.classCount).append("\n"); - sb.append("Days observed: ").append(s.daysObserved).append(" (acceptance threshold: ").append(s.acceptAfterDays).append(")\n"); + sb.append("\n"); } return sb.toString(); @@ -394,23 +404,25 @@ private JsonObject analyzeApplication(ClaudeClient client, AppEntry entry, boole fallback.addProperty("risk_level", "UNKNOWN"); fallback.addProperty("application_description", "Failed to parse AI response"); fallback.addProperty("recommendation", response.length() > 500 ? response.substring(0, 500) : response); - fallback.add("statements", new JsonArray()); return fallback; } - private int writeAssessmentsToVex(String vexPath, List results) throws IOException { - Map> assessmentsByAppAndCve = new LinkedHashMap<>(); - for (JsonObject r : results) { - String app = getString(r, "application", null); - if (app == null || !r.has("statements")) continue; - Map byCve = new LinkedHashMap<>(); - for (JsonElement el : r.getAsJsonArray("statements")) { - JsonObject s = el.getAsJsonObject(); - String cveId = getString(s, "cve_id", null); - if (cveId != null) byCve.put(cveId, s); - } - assessmentsByAppAndCve.put(app, byCve); - } + /** Short, deterministic explanation of why a statement was (or wasn't) flagged - see needsReview(). */ + private String reviewRationale(VexStatement s, AppEntry entry, boolean flagged) { + if (!flagged) return "sound"; + List reasons = new ArrayList<>(); + if (isAssessBlind(s, entry)) reasons.add("Assess has no runtime data in the environment(s) this claim covers"); + if (s.severity != null && ("critical".equalsIgnoreCase(s.severity) || "high".equalsIgnoreCase(s.severity))) { + reasons.add(s.severity.toUpperCase() + " severity"); + } + if (Boolean.TRUE.equals(s.cisaKev)) reasons.add("CISA KEV-listed"); + if (s.epssScore != null && s.epssScore >= 0.5) reasons.add("EPSS " + s.epssScore); + return "Flagged: " + String.join(", ", reasons) + " - duration-based claim, not a structural guarantee."; + } + + private int writeAssessmentsToVex(String vexPath, List entries) throws IOException { + Map entriesByName = new LinkedHashMap<>(); + for (AppEntry e : entries) entriesByName.put(e.name, e); JsonObject vex; try (FileReader reader = new FileReader(vexPath)) { @@ -424,11 +436,12 @@ private int writeAssessmentsToVex(String vexPath, List results) thro Map props = properties(v); String appName = props.getOrDefault("contrast:appName", "Unknown Application"); String cveId = getString(v, "id", null); + AppEntry entry = entriesByName.get(appName); + if (entry == null || cveId == null) continue; + VexStatement s = entry.statements.stream().filter(st -> cveId.equals(st.cveId)).findFirst().orElse(null); + if (s == null) continue; - Map byCve = assessmentsByAppAndCve.get(appName); - if (byCve == null || cveId == null || !byCve.containsKey(cveId)) continue; - - JsonObject assessment = byCve.get(cveId); + boolean flagged = needsReview(s, entry); JsonArray oldProperties = v.has("properties") ? v.getAsJsonArray("properties") : new JsonArray(); JsonArray properties = new JsonArray(); for (JsonElement propEl : oldProperties) { @@ -437,8 +450,8 @@ private int writeAssessmentsToVex(String vexPath, List results) thro properties.add(propEl); } } - properties.add(propertyJson("contrast:vexAdvisorAssessment", getString(assessment, "assessment", "unknown"))); - properties.add(propertyJson("contrast:vexAdvisorRationale", getString(assessment, "rationale", ""))); + properties.add(propertyJson("contrast:vexAdvisorAssessment", flagged ? "needs_review" : "sound")); + properties.add(propertyJson("contrast:vexAdvisorRationale", reviewRationale(s, entry, flagged))); v.add("properties", properties); written++; } @@ -467,20 +480,6 @@ private String generateReport(List appResults, List entrie Map entriesByName = new LinkedHashMap<>(); for (AppEntry e : entries) entriesByName.put(e.name, e); - // One assessment lookup per (app, cve), built once - avoids re-deriving it per section below. - Map> assessmentsByApp = new LinkedHashMap<>(); - for (JsonObject r : appResults) { - String app = getString(r, "application", null); - if (app == null || !r.has("statements")) continue; - Map byCve = new LinkedHashMap<>(); - for (JsonElement el : r.getAsJsonArray("statements")) { - JsonObject s = el.getAsJsonObject(); - String cveId = getString(s, "cve_id", null); - if (cveId != null) byCve.put(cveId, s); - } - assessmentsByApp.put(app, byCve); - } - Map riskCounts = new LinkedHashMap<>(); Map riskByApp = new LinkedHashMap<>(); for (JsonObject r : appResults) { @@ -498,11 +497,8 @@ private String generateReport(List appResults, List entrie List kevFlagged = new ArrayList<>(); List highEpssFlagged = new ArrayList<>(); for (AppEntry entry : entries) { - Map byCve = assessmentsByApp.getOrDefault(entry.name, Map.of()); for (VexStatement s : entry.statements) { - JsonObject assessment = byCve.get(s.cveId); - boolean flagged = assessment != null && "needs_review".equals(getString(assessment, "assessment", "")); - if (flagged) { + if (needsReview(s, entry)) { needsReviewCount++; if (Boolean.TRUE.equals(s.cisaKev)) kevFlagged.add(s); else if (s.epssScore != null && s.epssScore >= 0.5) highEpssFlagged.add(s); @@ -571,13 +567,15 @@ private String generateReport(List appResults, List entrie .append("enabled): `Yes` (Shield covers it, even if it hasn't fired), `No` (no Shield coverage for this ") .append("CVE at all - the claim rests entirely on absence-of-execution, with no possible active ") .append("backstop), `-` (unknown).\n\n"); - sb.append("**Rationale** - why the claim was made, with the day count for the three duration-based reasons:\n\n"); + sb.append("**Rationale** - why the claim was made, with the day count for the two duration-based reasons:\n\n"); sb.append("| Rationale | Meaning |\n|-----------|---------|\n"); sb.append("| `Library Unused` | Library never loaded at runtime (0 classes) - structural, not time-based |\n"); sb.append("| `CVE Shielded` | CVE Shield actively mitigating at runtime - an active control, not time-based |\n"); sb.append("| `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold |\n"); - sb.append("| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold - may still graduate to `CVE Not Used` |\n"); - sb.append("| `No Shield Coverage Nd` | in_triage, permanently - CVE Shield has no coverage for this CVE here (Shield column is `No`), so elapsed time is never evidence of anything and this can never graduate, no matter how large Nd gets |\n\n"); + sb.append("| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold - may still graduate to `CVE Not Used` |\n\n"); + sb.append("CVEs with no CVE Shield coverage at all never appear in this table - VEXGenerator excludes ") + .append("them entirely rather than claiming `not_affected` or `in_triage` without a detector ever having ") + .append("watched (see its console output for the excluded count).\n\n"); sb.append("Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth ") .append("a second look surface at the top - see the Key Findings above for which specific CVEs those are.\n\n"); sb.append("**Protection Status** (shown per app below) - Assess is the module that produces the runtime ") @@ -659,17 +657,13 @@ private String generateReport(List appResults, List entrie /** * Library Unused/CVE Shielded are structural. CVE Not Used/CVE Watching are duration-based and genuinely - * still accumulating toward (or past) the acceptance threshold. No Shield Coverage is also in_triage, but - * for a different reason - Shield has zero coverage for this CVE, so it stays in_triage forever regardless - * of daysObserved; using "CVE Watching Nd" for that case would make a 288-day-old in_triage claim look like - * a bug rather than the intended "can never graduate" state. + * still accumulating toward (or past) the acceptance threshold. CVEs with no CVE Shield coverage at all + * never reach this report - VEXGenerator excludes them entirely (see its decision-rule 3), since neither + * not_affected nor in_triage is a claim it can support without a detector ever having watched. */ private String rationaleWord(VexStatement s) { if ("code_not_reachable".equals(s.justification)) return "Library Unused"; if ("protected_at_runtime".equals(s.justification)) return "CVE Shielded"; - if ("in_triage".equals(s.state) && Boolean.FALSE.equals(s.shieldAvailable)) { - return "No Shield Coverage " + s.daysObserved + "d"; - } if ("in_triage".equals(s.state)) return "CVE Watching " + s.daysObserved + "d"; return "CVE Not Used " + s.daysObserved + "d"; } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java index 6f85f8c..1cd3f05 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java @@ -60,23 +60,22 @@ * Decision rules (see CLAUDE.md discussion - these are policy, not spec): * 1. classes_used == 0 for the app+library -> not_affected / code_not_reachable, unconditional. * 2. classes_used > 0, CVE's env status is PROTECTING/BLOCKED -> not_affected / protected_at_runtime. - * 3. classes_used > 0, CVE's env status is EXPOSED/EXPLOITED (or unrecognized) -> no VEX entry; + * 3. classes_used > 0, CVE Shield has no coverage for this CVE at all (org-wide cveShieldExists is false - + * see shieldAvailability()) -> no VEX entry. Coverage is a per-CVE, product-level fact, not an + * app/environment-scoped one - if Shield covers a CVE anywhere, it covers it everywhere Shield/ADR is + * enabled. Without it, "not observed executing" isn't evidence of anything (there was never a detector + * watching), so neither not_affected nor in_triage is a claim this tool can support - in_triage would be + * just as wrong, since it implies evidence is accumulating toward a future resolution that nothing here + * could ever produce. This is the same "can't positively account for it" bucket as rule 5 below, just a + * different root cause (no detection capability, vs. confirmed exploitation) - excluded CVEs are counted + * in the run's own console output, not silently dropped. + * 4. classes_used > 0, CVE's env status is NOT_SEEN (or missing) in every environment observed - Shield has + * coverage here (rule 3 didn't apply) and simply hasn't fired, so elapsed time is genuine evidence: + * - days observed >= acceptAfterDays -> not_affected (no justification), detail explains the + * day count and threshold as an operational risk-acceptance, not a structural guarantee. + * - days observed < acceptAfterDays -> in_triage, detail explains the day count so far. + * 5. classes_used > 0, CVE's env status is EXPOSED/EXPLOITED (or unrecognized) -> no VEX entry; * never suppress a vulnerability we can't positively account for. - * 4. classes_used > 0, CVE's env status is NOT_SEEN/NO_SHIELD (or missing) in every environment observed: - * NO_SHIELD (confirmed by scanning every app in this org) means CVE Shield has no coverage for this CVE - * at all, as opposed to NOT_SEEN (Shield exists and just hasn't fired). Coverage is a per-CVE, - * product-level fact, not an app/environment-scoped one - if Shield covers a CVE anywhere, it covers it - * everywhere Shield/ADR is enabled - so this is decided by the org-wide cveShieldExists flag (see - * shieldAvailability()), not by inferring it from per-app NO_SHIELD/NOT_SEEN status. This matters for - * the state, not just the reporting: elapsed time can never turn "no detector was watching" into - * "nothing happened," so: - * - shieldAvailability() is false (no coverage for this CVE, org-wide) -> in_triage, permanently, - * regardless of daysObserved - this can never graduate to not_affected on duration alone. - * - shieldAvailability() is true/unknown and days observed >= acceptAfterDays -> not_affected (no - * justification), detail explains the day count and threshold as an operational risk-acceptance, - * not a structural guarantee. - * - shieldAvailability() is true/unknown and days observed < acceptAfterDays -> in_triage, detail - * explains the day count so far (may still graduate to not_affected later). * * Not factored into the decision rules above (deliberately - see ModuleStatus): whether Assess/ADR are * even enabled per environment. A "not seen" claim scoped to an environment where Assess itself isn't running @@ -84,8 +83,6 @@ * as its own contrast:assessEnabled and contrast:adrEnabled property (per env) so a human (or the VEX * Advisor) can weigh it. ADR (formerly branded "Protect") is the classic HTTP-rule-based RASP module (the * API's `defend` flag) - a separate product from CVE Shield, which defends specific CVEs via a microsandbox. - * Whether CVE Shield could even catch this CVE at all - contrast:shieldAvailable - is the org-wide - * cveShieldExists flag from /cves, verbatim (see shieldAvailability()). * * Usage: * java -jar runtime-analyst.jar vex --app "MyApp" @@ -110,6 +107,11 @@ public class VEXGenerator { private int acceptAfterDays = 30; private String envFilter; // DEVELOPMENT, QA, or PRODUCTION - null means consider all three + // Counts of CVEs deliberately excluded from the VEX (no statement generated) because this tool can't + // positively account for them - tracked so the exclusion is visible in the run's own output, not silent. + private int excludedNoShieldCoverage = 0; + private int excludedExposedOrUnrecognized = 0; + private final Gson gson = new Gson(); private final CloseableHttpClient httpClient = HttpClients.createDefault(); @@ -573,6 +575,18 @@ public Bom generateVEX(List apps) throws IOException { } System.out.println("\nGenerated " + vulnerabilities.size() + " VEX statements."); + if (excludedNoShieldCoverage > 0 || excludedExposedOrUnrecognized > 0) { + System.out.println("Excluded " + (excludedNoShieldCoverage + excludedExposedOrUnrecognized) + + " CVE(s) - no VEX statement generated, since this tool can't positively account for them:"); + if (excludedNoShieldCoverage > 0) { + System.out.println(" " + excludedNoShieldCoverage + " have no CVE Shield coverage at all - " + + "absence-of-execution isn't evidence when nothing was ever watching"); + } + if (excludedExposedOrUnrecognized > 0) { + System.out.println(" " + excludedExposedOrUnrecognized + " are EXPOSED/EXPLOITED (or an " + + "unrecognized status) - genuinely affected, not a claim this tool makes"); + } + } bom.setVulnerabilities(vulnerabilities); bom.setComponents(appComponents); @@ -721,20 +735,19 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN analysis.setJustification(Justification.PROTECTED_AT_RUNTIME); detail = "CVE Shield is actively mitigating this vulnerability at runtime in " + app.name + " (" + envScopeLabel() + ")."; + } else if (Boolean.FALSE.equals(shieldAvailability(orgWideShieldExists))) { + // CVE Shield has no coverage for this CVE at all - there was never anything watching for an exploit + // attempt, so "not observed executing" isn't evidence of anything, and neither not_affected nor + // in_triage is a claim we can support. in_triage would be just as wrong: it implies evidence is + // accumulating toward a future resolution, but nothing is running that could ever produce one. This + // is the same "can't positively account for it" bucket as EXPOSED/EXPLOITED below - no VEX entry. + excludedNoShieldCoverage++; + return null; } else if (issue != null && isNotSeen(issue)) { - boolean shieldAvail = !Boolean.FALSE.equals(shieldAvailability(orgWideShieldExists)); detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used) but this CVE's " + "vulnerable code path has not been observed executing in " + app.name + " (" + envScopeLabel() + ") in " + daysObserved + " days of runtime monitoring"; - if (!shieldAvail) { - // CVE Shield has no coverage for this CVE here at all, so there was never anything watching for - // an exploit attempt - elapsed time cannot turn "nothing detected" into "nothing happened." This - // can never graduate to not_affected on duration alone, no matter how long it's been. - analysis.setState(State.IN_TRIAGE); - detail += ". CVE Shield has no coverage for this CVE in this environment scope, so there is no " - + "detection mechanism to have caught an exploit attempt - this cannot be resolved to " - + "not_affected by elapsed time alone, regardless of the " + acceptAfterDays + "-day threshold."; - } else if (daysObserved >= acceptAfterDays) { + if (daysObserved >= acceptAfterDays) { analysis.setState(State.NOT_AFFECTED); detail += " (policy threshold: " + acceptAfterDays + " days). Operational risk acceptance based on " + "runtime observation, not a structural non-reachability guarantee."; @@ -745,16 +758,10 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN } else if (issue == null) { // Library confirmed used, but no matching per-CVE environment record found at all - // treat the same as "not seen" using the same duration logic, but flag the missing join. - boolean shieldAvail = !Boolean.FALSE.equals(shieldAvailability(orgWideShieldExists)); detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used); no per-environment " + "CVE Shield/exposure record found for this CVE+version in " + app.name + ". Not observed " + "executing in " + daysObserved + " days of runtime monitoring for this application"; - if (!shieldAvail) { - analysis.setState(State.IN_TRIAGE); - detail += ". CVE Shield has no coverage for this CVE at all (org-wide), so there is no detection " - + "mechanism to have caught an exploit attempt - this cannot be resolved to not_affected by " - + "elapsed time alone, regardless of the " + acceptAfterDays + "-day threshold."; - } else if (daysObserved >= acceptAfterDays) { + if (daysObserved >= acceptAfterDays) { analysis.setState(State.NOT_AFFECTED); detail += " (policy threshold: " + acceptAfterDays + " days). Operational risk acceptance based on " + "runtime observation, not a structural non-reachability guarantee."; @@ -764,6 +771,7 @@ private Vulnerability buildVulnerability(AppInfo app, String group, String fileN } } else { // EXPOSED / EXPLOITED / any unrecognized status - never suppress. + excludedExposedOrUnrecognized++; return null; }