{
  "@id": "urn:uuid:9098006b-5eab-4d2f-b0cf-7a2c6c413ad1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 40,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:51:00.040518+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. already_fixed \u2014 The target repository already contains the fix for CVE-2007-1651. The upstream patch commit f5468087c2 (April 15, 2010) that removes cached DiscoveryInformation from session is present in the target's git history, plus additional security enhancements from commit 89fa771093 (July 13, 2011) that add null checking and ATTRIBUTE_LIST_KEY removal.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "already_fixed \u2014 The target repository already contains the fix for CVE-2007-1651. The upstream patch commit f5468087c2 (April 15, 2010) that removes cached DiscoveryInformation from session is present in the target's git history, plus additional security enhancements from commit 89fa771093 (July 13, 2011) that add null checking and ATTRIBUTE_LIST_KEY removal."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. already_fixed \u2014 The target repository (spring-security 5.7.11.tuxcare) already contains the security fixes for CVE-2007-1652. Both defensive measures from the upstream patches are present: (1) null check rejecting requests with missing DiscoveryInformation at lines 141-144, and (2) immediate session token removal at lines 149-150. These fixes were merged via upstream commits f5468087c2 (April 2010) and 89fa771...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "already_fixed \u2014 The target repository (spring-security 5.7.11.tuxcare) already contains the security fixes for CVE-2007-1652. Both defensive measures from the upstream patches are present: (1) null check rejecting requests with missing DiscoveryInformation at lines 141-144, and (2) immediate session token removal at lines 149-150. These fixes were merged via upstream commits f5468087c2 (April 2010) and 89fa771..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T20:56:39.821004+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Target version 4.2.12.RELEASE contains the upstream vendor fix for CVE-2010-3700. The vulnerability allowed bypassing security constraints by adding path parameters (semicolon-delimited segments) to URLs. Spring Security fixed this in versions 2.0.6 and 3.0.4 (Oct 2010) by introducing the HttpFirewall mechanism that strips/rejects path parameters before security pattern matching. Version 4.2.12...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Target version 4.2.12.RELEASE contains the upstream vendor fix for CVE-2010-3700. The vulnerability allowed bypassing security constraints by adding path parameters (semicolon-delimited segments) to URLs. Spring Security fixed this in versions 2.0.6 and 3.0.4 (Oct 2010) by introducing the HttpFirewall mechanism that strips/rejects path parameters before security pattern matching. Version 4.2.12..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T19:28:54.255209+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 is NOT AFFECTED in Spring Security 4.2.12.RELEASE. The vulnerable pattern (RunAsManager storing Authentication in a shared SecurityContext, allowing privilege escalation via race conditions) was fixed by upstream Spring Security developers in 2011-2012 (SEC-1750 and SEC-1967). The fix was already present in the upstream 4.2.12.RELEASE that TuxCare onboarded. The target code correc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 is NOT AFFECTED in Spring Security 4.2.12.RELEASE. The vulnerable pattern (RunAsManager storing Authentication in a shared SecurityContext, allowing privilege escalation via race conditions) was fixed by upstream Spring Security developers in 2011-2012 (SEC-1750 and SEC-1967). The fix was already present in the upstream 4.2.12.RELEASE that TuxCare onboarded. The target code correc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T23:05:47.086442+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2732 (CRLF injection in logout functionality) is NOT present in Spring Security 4.2.12.RELEASE. The target contains comprehensive defenses against this vulnerability that were already shipped in the upstream release before TuxCare onboarded it. Defense #1: FirewalledResponse validates all redirect locations for CR/LF characters (Pattern.compile(\"\\\\r|\\\\n\")) and throws IllegalArgumentExc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2732 (CRLF injection in logout functionality) is NOT present in Spring Security 4.2.12.RELEASE. The target contains comprehensive defenses against this vulnerability that were already shipped in the upstream release before TuxCare onboarded it. Defense #1: FirewalledResponse validates all redirect locations for CR/LF characters (Pattern.compile(\"\\\\r|\\\\n\")) and throws IllegalArgumentExc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T22:45:22.602531+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 affects Spring Security 3.0.0-3.0.5 and 2.0.0-2.0.6 via unsafe deserialization of SecurityContext objects in RMI remote invocations. The target version 4.2.12.RELEASE is NOT vulnerable because the upstream vendor (Spring Security project) fixed this vulnerability in version 3.0.6.RELEASE (May 2011, commit ba719dc0e1 by luke.taylor@springsource.com). The fix replaced SecurityContex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2894 affects Spring Security 3.0.0-3.0.5 and 2.0.0-2.0.6 via unsafe deserialization of SecurityContext objects in RMI remote invocations. The target version 4.2.12.RELEASE is NOT vulnerable because the upstream vendor (Spring Security project) fixed this vulnerability in version 3.0.6.RELEASE (May 2011, commit ba719dc0e1 by luke.taylor@springsource.com). The fix replaced SecurityContex..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:16:17.754543+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 (username enumeration via timing attack) is not present in Spring Security 4.2.12.RELEASE. The upstream vendor fix (commit c076f0f2e1 by Rob Winch/VMware, applied September 2012) was already included in the 4.2.12.RELEASE that TuxCare onboarded. The fix performs password validation against a pre-computed dummy password even when a user is not found (DaoAuthenticationProvider.java ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 (username enumeration via timing attack) is not present in Spring Security 4.2.12.RELEASE. The upstream vendor fix (commit c076f0f2e1 by Rob Winch/VMware, applied September 2012) was already included in the 4.2.12.RELEASE that TuxCare onboarded. The fix performs password validation against a pre-computed dummy password even when a user is not found (DaoAuthenticationProvider.java ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T17:39:06.990107+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2014-3527 (SEC-2688) is NOT present in target version 4.2.12.RELEASE. The vulnerability was fixed by upstream commit 934937d9c1 (authored by rwinch@gopivotal.com) which shipped in Spring Security 4.0.0.M2, well before the target version. The fix changes DefaultServiceAuthenticationDetails to use the pre-configured trusted service URL (protocol/host/port from ServiceProperties) instead of extracting these values from the untrusted HTTP request (Host header). The target code contains this fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 (SEC-2688) is NOT present in target version 4.2.12.RELEASE. The vulnerability was fixed by upstream commit 934937d9c1 (authored by rwinch@gopivotal.com) which shipped in Spring Security 4.0.0.M2, well before the target version. The fix changes DefaultServiceAuthenticationDetails to use the pre-configured trusted service URL (protocol/host/port from ServiceProperties) instead of extracting these values from the untrusted HTTP request (Host header). The target code contains this fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:32:43.249791+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2016-5007 affects Spring Security 3.2.x, 4.0.x, and 4.1.0 due to URL pattern matching differences between Spring Security authorization rules and Spring MVC controller mappings, allowing attackers to access protected endpoints via URL variations or encoded slashes. The target (Spring Security 4.2.12.RELEASE) is not affected because both upstream fixes were already present in the release: (1) MvcRequestMatcher (added in 4.1.1) provides Spring MVC-aligned URL matching to eliminate pattern matching discrepancies, and (2) StrictHttpFirewall (default since 4.2.4) blocks URL-encoded slashes by default. Both fixes were authored by the upstream maintainer (Rob Winch, Pivotal) and shipped in the upstream release that TuxCare onboarded in April 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 affects Spring Security 3.2.x, 4.0.x, and 4.1.0 due to URL pattern matching differences between Spring Security authorization rules and Spring MVC controller mappings, allowing attackers to access protected endpoints via URL variations or encoded slashes. The target (Spring Security 4.2.12.RELEASE) is not affected because both upstream fixes were already present in the release: (1) MvcRequestMatcher (added in 4.1.1) provides Spring MVC-aligned URL matching to eliminate pattern matching discrepancies, and (2) StrictHttpFirewall (default since 4.2.4) blocks URL-encoded slashes by default. Both fixes were authored by the upstream maintainer (Rob Winch, Pivotal) and shipped in the upstream release that TuxCare onboarded in April 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:58.427102+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2016-9879 is not present in Spring Security 4.2.12.RELEASE. The fix (commit 666e356ebc) that validates and rejects URL-encoded slashes (%2f/%2F) in request URIs was authored by Rob Winch (rwinch@gopivotal.com) from Pivotal/Spring and shipped in upstream release 4.2.1.RELEASE (December 2016). Since 4.2.12.RELEASE > 4.2.1.RELEASE, the target version inherited this fix from the upstream release before TuxCare onboarded it. The protection is active by default in DefaultHttpFirewall at lines 60-63 and 91-101, with no production code disabling it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "CVE-2016-9879 is not present in Spring Security 4.2.12.RELEASE. The fix (commit 666e356ebc) that validates and rejects URL-encoded slashes (%2f/%2F) in request URIs was authored by Rob Winch (rwinch@gopivotal.com) from Pivotal/Spring and shipped in upstream release 4.2.1.RELEASE (December 2016). Since 4.2.12.RELEASE > 4.2.1.RELEASE, the target version inherited this fix from the upstream release before TuxCare onboarded it. The protection is active by default in DefaultHttpFirewall at lines 60-63 and 91-101, with no production code disabling it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. The target Spring Security 4.2.12.RELEASE-tuxcare.1 is NOT vulnerable to CVE-2017-4995. The vulnerable Jackson deserialization pattern (unprotected default typing) is not present because the upstream fix was already included in the 4.2.12.RELEASE that TuxCare onboarded. The fix (commit 947d11f433 by Rob Winch) introduced whitelist-based class validation during type resolution, first released in upstream 4.2.10.RELEASE. The CVE affected versions 4.2.0-4.2.2.RELEASE; the target version contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "The target Spring Security 4.2.12.RELEASE-tuxcare.1 is NOT vulnerable to CVE-2017-4995. The vulnerable Jackson deserialization pattern (unprotected default typing) is not present because the upstream fix was already included in the 4.2.12.RELEASE that TuxCare onboarded. The fix (commit 947d11f433 by Rob Winch) introduced whitelist-based class validation during type resolution, first released in upstream 4.2.10.RELEASE. The CVE affected versions 4.2.0-4.2.2.RELEASE; the target version contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:46:51.408476+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 4.2.12.RELEASE is not affected by CVE-2018-1199. The vulnerability allows bypassing security constraints via URL path parameters (semicolons and encoded characters). The fix (StrictHttpFirewall) was introduced in Spring Security 4.2.4 and is present in 4.2.12.RELEASE. The target uses StrictHttpFirewall as the default firewall, which rejects requests containing semicolons and oth...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Spring Security 4.2.12.RELEASE is not affected by CVE-2018-1199. The vulnerability allows bypassing security constraints via URL path parameters (semicolons and encoded characters). The fix (StrictHttpFirewall) was introduced in Spring Security 4.2.4 and is present in 4.2.12.RELEASE. The target uses StrictHttpFirewall as the default firewall, which rejects requests containing semicolons and oth..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:35:19.509134+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 4.2.12.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-27xw-p8v6-9jjr (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 4.2.12.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-27xw-p8v6-9jjr (newer lines only), CVE record (newer lines only)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 is fixed in version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2019-11272"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. already_fixed \u2014 CVE-2019-3795 is already fixed in Spring Security 4.2.12.RELEASE. The target version contains the security patch (commit 6f02f690ac6, March 2019) that prevents insecure randomness by forcing SecureRandom auto-seeding before applying custom seeds.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "impact_statement": "already_fixed \u2014 CVE-2019-3795 is already fixed in Spring Security 4.2.12.RELEASE. The target version contains the security patch (commit 6f02f690ac6, March 2019) that prevents insecure randomness by forcing SecureRandom auto-seeding before applying custom seeds."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "action_statement": "Vulnerability CVE-2020-5408 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:13:19.740563+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security version 4.2.12.RELEASE is NOT affected by CVE-2022-22976. The vulnerable code pattern (integer overflow in BCrypt rounds calculation) is not present in this version. Historical analysis confirms that version 4.2.12.RELEASE (released April 2019) is based on a code branch from before the October 2018 refactoring that introduced the vulnerability. The target code uses the safe impl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 Spring Security version 4.2.12.RELEASE is NOT affected by CVE-2022-22976. The vulnerable code pattern (integer overflow in BCrypt rounds calculation) is not present in this version. Historical analysis confirms that version 4.2.12.RELEASE (released April 2019) is based on a code branch from before the October 2018 refactoring that introduced the vulnerability. The target code uses the safe impl..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 is fixed in version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:18:00.046080+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 4.2.12.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 4.2.12.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:16:00.061099+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout automatically clears stored authentication, including serialized session state. The cleared context is saved in web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:108. Saving an empty context removes the session attribute by key when the request began authenticated, even if the session is retained (web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:340).",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout automatically clears stored authentication, including serialized session state. The cleared context is saved in web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:108. Saving an empty context removes the session attribute by key when the request began authenticated, even if the session is retained (web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:340)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:28:06.753409+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:48:47.972282+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 4.2.12.RELEASE does not contain the @AuthorizeReturnObject annotation that is the subject of CVE-2024-38810. This annotation was introduced in Spring Security 6.x as part of the AuthorizationManager-based architecture. The target version (4.2.12) uses the older AccessDecisionManager/Voter architecture with annotations @PreAuthorize, @PostAuthorize, @PreFilter, @PostFilter, @Secu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 4.2.12.RELEASE does not contain the @AuthorizeReturnObject annotation that is the subject of CVE-2024-38810. This annotation was introduced in Spring Security 6.x as part of the AuthorizationManager-based architecture. The target version (4.2.12) uses the older AccessDecisionManager/Voter architecture with annotations @PreAuthorize, @PostAuthorize, @PreFilter, @PostFilter, @Secu..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:18:37.843029+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 4.2.12.RELEASE is NOT affected by CVE-2025-22223. The vulnerability exists only in Spring Security 5.6+ where the new @EnableMethodSecurity API and UniqueSecurityAnnotationScanner class were introduced. This version uses the older @EnableGlobalMethodSecurity API with AnnotationUtils.findAnnotation() which correctly handles generic type resolution through Spring Framework's bridg...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 4.2.12.RELEASE is NOT affected by CVE-2025-22223. The vulnerability exists only in Spring Security 5.6+ where the new @EnableMethodSecurity API and UniqueSecurityAnnotationScanner class were introduced. This version uses the older @EnableGlobalMethodSecurity API with AnnotationUtils.findAnnotation() which correctly handles generic type resolution through Spring Framework's bridg..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "action_statement": "Vulnerability CVE-2025-22234 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:45:04.635215+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 4.2.12.RELEASE does not contain that scanner, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 4.2.12.RELEASE does not contain that scanner, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T11:34:00.087002+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 4.2.12.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 4.2.12.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      },
      "action_statement": "Vulnerability CVE-2026-22746 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T05:55:31.824924+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 4.2.12.RELEASE is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token authentication feature do not exist in this version. The feature was introduced in Spring Security 6.4.0, which is 2+ major versions ahead of the target. No code path exists to process one-time token authentication requests. This is a Type A1 case wh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 4.2.12.RELEASE is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token authentication feature do not exist in this version. The feature was introduced in Spring Security 6.4.0, which is 2+ major versions ahead of the target. No code path exists to process one-time token authentication requests. This is a Type A1 case wh..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-13T10:54:00.087057+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T10:38:18.047933+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 4.2.12.RELEASE does not contain the InetAddressMatchers utility class that is vulnerable in this CVE. The feature (matchInternal/matchExternal builders for IP address classification) was introduced in a much later version of Spring Security. The target version predates this functionality entirely, making it not affected by CVE-2026-59277.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 4.2.12.RELEASE does not contain the InetAddressMatchers utility class that is vulnerable in this CVE. The feature (matchInternal/matchExternal builders for IP address classification) was introduced in a much later version of Spring Security. The target version predates this functionality entirely, making it not affected by CVE-2026-59277."
    }
  ]
}