{
  "@id": "urn:uuid:50571895-a9f3-47ac-b5c9-6c1421797e54",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T18:44:00.111620+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 5.1.2.RELEASE is not affected by CVE-2010-3700 (path parameter bypass). The vulnerability was fixed in upstream Spring Security 2.0.6 and 3.0.4 via SEC-1584, which introduced HttpFirewall infrastructure to strip path parameters from URLs before security pattern matching. Version 5.1.2.RELEASE ships with StrictHttpFirewall that rejects semicolons by default, providing even...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-3700"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 5.1.2.RELEASE is not affected by CVE-2010-3700 (path parameter bypass). The vulnerability was fixed in upstream Spring Security 2.0.6 and 3.0.4 via SEC-1584, which introduced HttpFirewall infrastructure to strip path parameters from URLs before security pattern matching. Version 5.1.2.RELEASE ships with StrictHttpFirewall that rejects semicolons by default, providing even..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 5.1.2.RELEASE. The vulnerability involved a race condition where RunAsManager stored Authentication in a shared SecurityContext, allowing privilege escalation across threads. Both upstream fixes (SEC-1750 and SEC-1967) are present in the target: (1) SecurityContext isolation - creates new empty context for RunAs instead of modifying shared context...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2731"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-2731 is NOT present in Spring Security 5.1.2.RELEASE. The vulnerability involved a race condition where RunAsManager stored Authentication in a shared SecurityContext, allowing privilege escalation across threads. Both upstream fixes (SEC-1750 and SEC-1967) are present in the target: (1) SecurityContext isolation - creates new empty context for RunAs instead of modifying shared context..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2011-2732 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.2.RELEASE is not vulnerable to CVE-2011-2732 (CRLF injection in logout functionality). The target contains both defenses from the 2011 upstream patches: (1) FirewalledResponse validates and rejects CR/LF characters in all redirect locations before calling sendRedirect(); (2) AbstractAuthenticationTargetUrlRequestHandler defaults targetUrlParameter to null, so the spring-secu...",
      "vulnerability": {
        "name": "CVE-2011-2732"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.2.RELEASE is not vulnerable to CVE-2011-2732 (CRLF injection in logout functionality). The target contains both defenses from the 2011 upstream patches: (1) FirewalledResponse validates and rejects CR/LF characters in all redirect locations before calling sendRedirect(); (2) AbstractAuthenticationTargetUrlRequestHandler defaults targetUrlParameter to null, so the spring-secu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.2.RELEASE is NOT vulnerable to CVE-2011-2894. The vulnerable deserialization pattern (serializing entire SecurityContext objects in ContextPropagatingRemoteInvocation) was fixed by upstream Spring Security in commit b48fc53fa2 (SEC-1741, 2011-08-12) authored by Luke Taylor. This fix was already present in the upstream 5.1.2.RELEASE when TuxCare onboarded it. The current code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.2.RELEASE is NOT vulnerable to CVE-2011-2894. The vulnerable deserialization pattern (serializing entire SecurityContext objects in ContextPropagatingRemoteInvocation) was fixed by upstream Spring Security in commit b48fc53fa2 (SEC-1741, 2011-08-12) authored by Luke Taylor. This fix was already present in the upstream 5.1.2.RELEASE when TuxCare onboarded it. The current code..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2012-5055 (timing side-channel username enumeration) is NOT present in Spring Security 5.1.2.RELEASE. The upstream fix from commit c076f0f2e1 (SEC-2056, authored by Rob Winch @vmware.com in 2012 for version 3.1.3.RELEASE) was already included in the upstream 5.1.2.RELEASE that TuxCare onboarded. The target code contains the complete timing attack mitigation: prepareTimingAttackProtection() ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5055"
      },
      "impact_statement": "not_affected \u2014 CVE-2012-5055 (timing side-channel username enumeration) is NOT present in Spring Security 5.1.2.RELEASE. The upstream fix from commit c076f0f2e1 (SEC-2056, authored by Rob Winch @vmware.com in 2012 for version 3.1.3.RELEASE) was already included in the upstream 5.1.2.RELEASE that TuxCare onboarded. The target code contains the complete timing attack mitigation: prepareTimingAttackProtection() ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2014-0097 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2014-0097"
      },
      "action_statement": "Vulnerability CVE-2014-0097 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2014-3527 is NOT present in Spring Security 5.1.2.RELEASE. The vulnerability (using untrusted HTTP request headers to build the CAS service URL) was fixed by the upstream Spring Security team in commit 934937d9c1dc20c396b96c08310b72cfa627acbf (July 2014) by Rob Winch. This fix was already included in the upstream 5.1.2.RELEASE version before TuxCare onboarded it. The target code uses the configured service URL from ServiceProperties instead of HTTP request headers, preventing attackers from manipulating the service URL used in CAS proxy ticket authentication.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3527"
      },
      "impact_statement": "CVE-2014-3527 is NOT present in Spring Security 5.1.2.RELEASE. The vulnerability (using untrusted HTTP request headers to build the CAS service URL) was fixed by the upstream Spring Security team in commit 934937d9c1dc20c396b96c08310b72cfa627acbf (July 2014) by Rob Winch. This fix was already included in the upstream 5.1.2.RELEASE version before TuxCare onboarded it. The target code uses the configured service URL from ServiceProperties instead of HTTP request headers, preventing attackers from manipulating the service URL used in CAS proxy ticket authentication."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2016-5007 addresses URL pattern matching inconsistencies between Spring Security's authorization rules and Spring MVC's controller mappings. The vulnerability allowed attackers to bypass authorization by exploiting differences in how paths like \"/admin\", \"/admin/\", and \"/admin.html\" were matched. Spring Security 5.1.2.RELEASE (released November 2018) includes both upstream fixes: MvcRequestMatcher (added July 2016) which uses Spring MVC's HandlerMappingIntrospector for consistent matching, and DefaultHttpFirewall's URL-encoded slash blocking (added December 2016). Both fixes were already present in the upstream release when TuxCare onboarded version 5.1.2.RELEASE in commit 61ac350063. The target is not affected because the vulnerable pattern was removed by upstream before the 5.1.2.RELEASE was cut.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "impact_statement": "CVE-2016-5007 addresses URL pattern matching inconsistencies between Spring Security's authorization rules and Spring MVC's controller mappings. The vulnerability allowed attackers to bypass authorization by exploiting differences in how paths like \"/admin\", \"/admin/\", and \"/admin.html\" were matched. Spring Security 5.1.2.RELEASE (released November 2018) includes both upstream fixes: MvcRequestMatcher (added July 2016) which uses Spring MVC's HandlerMappingIntrospector for consistent matching, and DefaultHttpFirewall's URL-encoded slash blocking (added December 2016). Both fixes were already present in the upstream release when TuxCare onboarded version 5.1.2.RELEASE in commit 61ac350063. The target is not affected because the vulnerable pattern was removed by upstream before the 5.1.2.RELEASE was cut.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2016-9879 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 5.1.2.RELEASE is not affected by CVE-2016-9879. The vulnerability (security constraint bypass via URL-encoded slash in path parameters) was fixed in the upstream Spring Security release in December 2016 (commit 666e356ebc). The fix was already present in the upstream 5.1.2.RELEASE that TuxCare onboarded, so no TuxCare backport was needed. The DefaultHttpFirewall class contains the containsInvalidUrlEncodedSlash() method that rejects requests with %2f or %2F by default, preventing the security bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-9879"
      },
      "impact_statement": "The target Spring Security 5.1.2.RELEASE is not affected by CVE-2016-9879. The vulnerability (security constraint bypass via URL-encoded slash in path parameters) was fixed in the upstream Spring Security release in December 2016 (commit 666e356ebc). The fix was already present in the upstream 5.1.2.RELEASE that TuxCare onboarded, so no TuxCare backport was needed. The DefaultHttpFirewall class contains the containsInvalidUrlEncodedSlash() method that rejects requests with %2f or %2F by default, preventing the security bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 5.1.2.RELEASE is not affected by CVE-2017-4995. The vulnerability (unrestricted Jackson default typing allowing arbitrary code execution via deserialization) was fixed by upstream commit 5dee8534cd on 2017-05-31, over a year before 5.1.2.RELEASE was published on 2018-11-28. The fix introduced a whitelisting mechanism (WhitelistTypeIdResolver) that blocks deserialization of arbitrary classes unless they are: (1) in a hardcoded whitelist, (2) have an explicit Jackson mixin, or (3) are annotated with Jackson annotations. This upstream fix was already present when TuxCare onboarded version 5.1.2.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-4995"
      },
      "impact_statement": "The target Spring Security 5.1.2.RELEASE is not affected by CVE-2017-4995. The vulnerability (unrestricted Jackson default typing allowing arbitrary code execution via deserialization) was fixed by upstream commit 5dee8534cd on 2017-05-31, over a year before 5.1.2.RELEASE was published on 2018-11-28. The fix introduced a whitelisting mechanism (WhitelistTypeIdResolver) that blocks deserialization of arbitrary classes unless they are: (1) in a hardcoded whitelist, (2) have an explicit Jackson mixin, or (3) are annotated with Jackson annotations. This upstream fix was already present when TuxCare onboarded version 5.1.2.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Target Spring Security 5.1.2.RELEASE is NOT AFFECTED. The vulnerability (CVE-2018-1199) allows bypassing security constraints via URL path parameters with special encodings (semicolons, encoded slashes). The upstream vendor fix (commit 0eef5b4b42 by Rob Winch) introduced StrictHttpFirewall, which validates and rejects requests containing malicious URL encodings. This fix was already present in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "impact_statement": "not_affected \u2014 Target Spring Security 5.1.2.RELEASE is NOT AFFECTED. The vulnerability (CVE-2018-1199) allows bypassing security constraints via URL path parameters with special encodings (semicolons, encoded slashes). The upstream vendor fix (commit 0eef5b4b42 by Rob Winch) introduced StrictHttpFirewall, which validates and rejects requests containing malicious URL encodings. This fix was already present in ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. CVE-2018-15801 is NOT present in this target. The vulnerability involved JWT issuer validation using Java's URL.equals() method, which performs DNS resolution and could allow authorization bypass when two different issuer URLs resolve to the same IP. The target at version 5.1.2.RELEASE contains the upstream fix (commits dc4aa3d017 and 5478b74116) that replaced URL.equals() comparison with String comparison in both JwtIssuerValidator and MappedJwtClaimSetConverter. This fix was authored by Josh Cummings (josh.cummings@gmail.com) and shipped in the upstream Spring Security 5.1.2.RELEASE before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15801"
      },
      "impact_statement": "CVE-2018-15801 is NOT present in this target. The vulnerability involved JWT issuer validation using Java's URL.equals() method, which performs DNS resolution and could allow authorization bypass when two different issuer URLs resolve to the same IP. The target at version 5.1.2.RELEASE contains the upstream fix (commits dc4aa3d017 and 5478b74116) that replaced URL.equals() comparison with String comparison in both JwtIssuerValidator and MappedJwtClaimSetConverter. This fix was authored by Josh Cummings (josh.cummings@gmail.com) and shipped in the upstream Spring Security 5.1.2.RELEASE before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. The target Spring Security 5.1.2.RELEASE is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in version 5.0 (October 2017, commit 12dbf2e961), nearly 2 years before the CVE was disclosed in June 2019. The removal was part of upstream Spring Security's architectural refactoring, where the deprecated authentication.encoding package was replaced by the crypto.password package with modern password encoders. The target version does not contain PlaintextPasswordEncoder anywhere in its codebase, and the replacement NoOpPasswordEncoder does not have the null-to-string conversion vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "The target Spring Security 5.1.2.RELEASE is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in version 5.0 (October 2017, commit 12dbf2e961), nearly 2 years before the CVE was disclosed in June 2019. The removal was part of upstream Spring Security's architectural refactoring, where the deprecated authentication.encoding package was replaced by the crypto.password package with modern password encoders. The target version does not contain PlaintextPasswordEncoder anywhere in its codebase, and the replacement NoOpPasswordEncoder does not have the null-to-string conversion vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2019-3795 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2019-3795"
      },
      "action_statement": "Vulnerability CVE-2019-3795 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2020-5407 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5407"
      },
      "action_statement": "Vulnerability CVE-2020-5407 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2020-5408 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2020-5408"
      },
      "action_statement": "Vulnerability CVE-2020-5408 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "action_statement": "Vulnerability CVE-2021-22119 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Target version 5.1.2.RELEASE is NOT affected by CVE-2022-22976. The vulnerable code pattern (integer overflow causing zero salt rounds) is not present. An upstream fix from 2012 (commit 14a5135ac3) uses long type for rounds calculation, preventing the overflow that would occur with int type when log_rounds=31. This fix was shipped in the upstream Spring Security 5.1.2.RELEASE before TuxCare onb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22976"
      },
      "impact_statement": "not_affected \u2014 Target version 5.1.2.RELEASE is NOT affected by CVE-2022-22976. The vulnerable code pattern (integer overflow causing zero salt rounds) is not present. An upstream fix from 2012 (commit 14a5135ac3) uses long type for rounds calculation, preventing the overflow that would occur with int type when log_rounds=31. This fix was shipped in the upstream Spring Security 5.1.2.RELEASE before TuxCare onb..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2022-31692 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31692"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2023-20862 affects Spring Security 5.7.x+, 5.8.x+, 6.0.x+ when using explicit save mode (requireExplicitSave=true), a feature introduced in August 2022. Version 5.1.2.RELEASE (December 2018) does not have this feature and uses automatic context save via SecurityContextPersistenceFilter. The target contains the SEC-1587 defense (added circa 2010) that removes the SPRING_SECURITY_CONTEXT sess...",
      "vulnerability": {
        "name": "CVE-2023-20862"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20862 affects Spring Security 5.7.x+, 5.8.x+, 6.0.x+ when using explicit save mode (requireExplicitSave=true), a feature introduced in August 2022. Version 5.1.2.RELEASE (December 2018) does not have this feature and uses automatic context save via SecurityContextPersistenceFilter. The target contains the SEC-1587 defense (added circa 2010) that removes the SPRING_SECURITY_CONTEXT sess..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2024-22234 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22234"
      },
      "action_statement": "Vulnerability CVE-2024-22234 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:00.111620+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2024-38810 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.2.RELEASE is not affected by CVE-2024-38810. This vulnerability is specific to the @EnableMethodSecurity architecture introduced in Spring Security 6.x. The target version uses the older @EnableGlobalMethodSecurity architecture with fundamentally different advisor registration mechanisms. The affected components (MethodSecurityAdvisorRegistrar, AuthorizationAdvisor interface...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38810"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.2.RELEASE is not affected by CVE-2024-38810. This vulnerability is specific to the @EnableMethodSecurity architecture introduced in Spring Security 6.x. The target version uses the older @EnableGlobalMethodSecurity architecture with fundamentally different advisor registration mechanisms. The affected components (MethodSecurityAdvisorRegistrar, AuthorizationAdvisor interface..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      },
      "action_statement": "Vulnerability CVE-2024-38827 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.0 to 6.4.3 as affected, so this version is older than the affected range; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.0 to 6.4.3 as affected, so this version is older than the affected range; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 5.1.2.RELEASE is not affected by CVE-2025-22234 because it lacks the prerequisite CVE-2025-22228 fix that introduced the broken timing attack mitigation. CVE-2025-22234 specifically addresses a timing attack issue caused by CVE-2025-22228's password length enforcement, which throws exceptions during password matching. Since the target has no 72-byte password limit in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 The target Spring Security 5.1.2.RELEASE is not affected by CVE-2025-22234 because it lacks the prerequisite CVE-2025-22228 fix that introduced the broken timing attack mitigation. CVE-2025-22234 specifically addresses a timing attack issue caused by CVE-2025-22228's password length enforcement, which throws exceptions during password matching. Since the target has no 72-byte password limit in ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2025-41232 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2025-41232"
      },
      "action_statement": "Vulnerability CVE-2025-41232 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2025-41248 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-8v5q-rhf3-jphm (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41248"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-8v5q-rhf3-jphm (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:00.111620+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2026-22751 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.2.RELEASE is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) does not exist in this version. The OTT feature was introduced in Spring Security 6.x series, approximately 3+ years after the 5.1.2.RELEASE version. Exhaustive search confirms no database-backed, single-use token authentication...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22751"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.2.RELEASE is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) does not exist in this version. The OTT feature was introduced in Spring Security 6.x series, approximately 3+ years after the 5.1.2.RELEASE version. Exhaustive search confirms no database-backed, single-use token authentication..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-core@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.1.2.RELEASE is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers with matchInternal()/matchExternal() builder methods does not exist in this version. The CVE affects a utility class introduced in later versions (6.x+) that classifies IP addresses as internal vs external. Version 5.1.2 only has IpAddressMatcher which serves a different purpose (matchi...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59277"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.2.RELEASE is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers with matchInternal()/matchExternal() builder methods does not exist in this version. The CVE affects a utility class introduced in later versions (6.x+) that classifies IP addresses as internal vs external. Version 5.1.2 only has IpAddressMatcher which serves a different purpose (matchi..."
    }
  ]
}